4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b

General

Target

4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
Size

164KB
MD5

16a4f72a115d2ba72770bbc53dda8d50
SHA1

e8a1167df93b6f5cc40cfa8f78fa14144b8735b1
SHA256

4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b
SHA512

2d2b8a4dceebf0a6576c6b979e30ba476e060e99ffd36a26b8966ec18cc287e099a46db6d39732be52a42432c38de49ca573062e03395abd0ffbd140addbd530
SSDEEP

3072:wJfrOsX6d5/hadTRl6ZghWyZokJZ1dTzcTWyQ9:kqKahadTPOspJZvT

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376822158"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F296B141-72E6-11ED-A993-42FEA5F7B9B2} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
Token: SeDebugPrivilege	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
Token: SeDebugPrivilege	1768	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1732 wrote to memory of 1692	1732	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	28
PID 1692 wrote to memory of 1700	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	29
PID 1692 wrote to memory of 1700	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	29
PID 1692 wrote to memory of 1700	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	29
PID 1692 wrote to memory of 1700	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	29
PID 1700 wrote to memory of 1204	1700	iexplore.exe	30
PID 1700 wrote to memory of 1204	1700	iexplore.exe	30
PID 1700 wrote to memory of 1204	1700	iexplore.exe	30
PID 1700 wrote to memory of 1204	1700	iexplore.exe	30
PID 1204 wrote to memory of 1768	1204	IEXPLORE.EXE	32
PID 1204 wrote to memory of 1768	1204	IEXPLORE.EXE	32
PID 1204 wrote to memory of 1768	1204	IEXPLORE.EXE	32
PID 1204 wrote to memory of 1768	1204	IEXPLORE.EXE	32
PID 1692 wrote to memory of 1768	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	32
PID 1692 wrote to memory of 1768	1692	4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe	32

C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
"C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
  C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RML7GEO8.txt

Filesize
535B

MD5
846c9ac1bb9c56d4372b844dfe816258

SHA1
d52c770456b35caefed4dfb1102356277d3a72c9

SHA256
1ae1dd2016a18b1c9a6a90111dc9c38480878d7cd4398003bc943992d526c69c

SHA512
4491efd1bf5212e70d706a4f546f27b8fa3f29b8a593dfc6ebb8cf2831ffa6832d5939bbcad234db32f88fc85d12f8533d0f1ba485b24b9cfb00a23c757e6485

Download Submit
memory/1692-88-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-57-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1692-58-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1692-59-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1692-62-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-64-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-66-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-68-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-70-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-72-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-74-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-76-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-78-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-80-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-82-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-84-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-86-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-110-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-92-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-94-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-96-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-98-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-100-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-102-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-104-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-106-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-108-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-90-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-112-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-116-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-114-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-118-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-120-0x00000000002C0000-0x000000000030E000-memory.dmp

Filesize
312KB

Download
memory/1692-123-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1692-54-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing