d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743

General

Target

d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
Size

38KB
MD5

319e6acc4cf60abfd3c42f737f907d4e
SHA1

ae6f911670d7b6fc80a9374b9dd7eb49d1d296c5
SHA256

d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743
SHA512

85e01457e8548a39f236c4a4c619276cf92ca5211b63424c2ee1ef524ca5a476350d199ed6d7b7e319b7303d48e8324df5b1e3ed0cf37218f11d15786d869901
SSDEEP

768:FFe7tEyaKaorzIgQGgV7qw2ZqoAX7W8UnY7:/caKaorzIgzgZqwmqRX7IY7

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 1624	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32:server.exe	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
File created	C:\Windows\system32:server.exe	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A455751-7357-11ED-BBEB-FA28CBED7ACF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376870542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Windows\system32:server.exe	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
File opened for modification	C:\Windows\system32:server.exe	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	992	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
Token: SeIncBasePriorityPrivilege	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1624	iexplore.exe
1624	iexplore.exe
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2024	992	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	27
PID 992 wrote to memory of 2024	992	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	27
PID 992 wrote to memory of 2024	992	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	27
PID 992 wrote to memory of 2024	992	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	27
PID 2024 wrote to memory of 1624	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	28
PID 2024 wrote to memory of 1624	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	28
PID 2024 wrote to memory of 1624	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	28
PID 2024 wrote to memory of 1624	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	28
PID 2024 wrote to memory of 1624	2024	d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe	28
PID 1624 wrote to memory of 1760	1624	iexplore.exe	30
PID 1624 wrote to memory of 1760	1624	iexplore.exe	30
PID 1624 wrote to memory of 1760	1624	iexplore.exe	30
PID 1624 wrote to memory of 1760	1624	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
"C:\Users\Admin\AppData\Local\Temp\d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
  "C:\Users\Admin\AppData\Local\Temp\d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe" -s
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\d6065c4e700d99a2d864e9dc2bb79150494397de681334e9c2a2581be3b4a743.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4ASJIMBS.txt

Filesize
535B

MD5
2ef40038fbf88bedfc789e4fb9b04ea8

SHA1
20869cb585af0e81bcaefe04cdf6ab3c331ae0ec

SHA256
88dd5df42b4fd8f4a3cfd7661dc0cc80f6f04a1acda5ff730bf48796d3a08f31

SHA512
d9f8039a24756c0e4a809b371892eee814fa21ef02b35d51063157f39e9e730036eab43971904f84b0b1d65a06ff9df5b940fd8b65efbc50849968af4df24a80

Download Submit
memory/992-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing