f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855

General

Target

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
Size

54KB
MD5

6a0d2e1ddcdb4f1461ef6a4a3704bec4
SHA1

01779463bb41dadf41e3f164df5083a6972333bf
SHA256

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855
SHA512

8df5c43a0e345dabc0e5942a80be1e763e105e172c9444255cd0a9e80fad624acfded3570cc3f4fc2d6038f5eebc6190311ef1ba1349cec661187204e991fdab
SSDEEP

1536:TkiS+EXghBTM3Pa8+jz/3N35dw3NuuWUssgpSkPunouy8W:TkgEwHMfsxTqNmUsbpSkPuoutW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

description	pid	process	target process
PID 904 set thread context of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376873455"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62D454E1-735E-11ED-B59B-4A4A572A2DE9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecefe22bc309aa4bb9e0ddb24c6067490000000002000000000010660000000100002000000011094d01a6985dbe3336c37c7882fa32b6302d01bdc8db623dad986160fed3df000000000e8000000002000020000000d8f340b73840747a392a4b940218bdb968e82e9febe169b68ccf648fcd6d4e4d90000000125ce529d59ad91b09c65237a5cd3a6082d93ab40c8346ea2c0b02aac1043356aad220e328814371d3ddd342481a39fb454381e7301eee8e34668135bd992953e77b83b95d3bb235246cf23702c69315a99994851695257d2d4ebe899c8dc94e34562abeb5b02023d590ab5001c5e00d3422da1cec80c11cc48a48a575fbecd6d171ab93876e1eccd6babb21120b4f9940000000c431bfb98744bf5fc308b9aff5130c756b019aad1462117e4f17411d3da65bd32365ccd1af88f4bf6372bd9b3ad7baf0e31e7f73f7b2bdc9ee361518b2667255	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ecefe22bc309aa4bb9e0ddb24c60674900000000020000000000106600000001000020000000c80538eeb4158141bf7e09d7a482fbc2396b8f474c664c93f59a761333d71b0c000000000e80000000020000200000003cdf7c1f3da8eb2fcce6a02234bbbb24fc3902e80e148af47d149f9d5568557920000000797ff7a60da0e189773f7727517e98d1e86770373f6331d2cba5f02745ff173940000000c5fb9655ae76cfc6e63dac321e58a8227c319396ac0fa617833e74828b6a181790e22c38ae2ad3ae6d45b348ffdebccca835f395babebf89f2a2e817fa19b01d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e184426b07d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1148 iexplore.exe

pid	process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exeiexplore.exeIEXPLORE.EXE

pid	process
904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
1148	iexplore.exe
1148	iexplore.exe
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exef3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exeiexplore.exe

description	pid	process	target process
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 904 wrote to memory of 1396	904	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 1396 wrote to memory of 1148	1396	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	iexplore.exe
PID 1396 wrote to memory of 1148	1396	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	iexplore.exe
PID 1396 wrote to memory of 1148	1396	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	iexplore.exe
PID 1396 wrote to memory of 1148	1396	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	iexplore.exe
PID 1148 wrote to memory of 812	1148	iexplore.exe	IEXPLORE.EXE
PID 1148 wrote to memory of 812	1148	iexplore.exe	IEXPLORE.EXE
PID 1148 wrote to memory of 812	1148	iexplore.exe	IEXPLORE.EXE
PID 1148 wrote to memory of 812	1148	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
"C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
"C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CQYZTDKG.txt

Filesize
608B

MD5
5d6464aa00b9cd554eb682622868e6a4

SHA1
1f82638d13df52bcd4f2d139a1005240bb57552a

SHA256
3b5a38b8127a92ec3f2acc81c5b4edc45bdbe4b786799040ec833a1eefb4df3a

SHA512
9a5e3d0cf4e27347c97ad8676035c7bfa6ee91fc08f3732bb8534ffe2fa523c8c3f3466488c3879fe98b85cd44443a8c6035b2c1f8e24c52f87d97720685eb90

Download Submit
memory/904-56-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/904-62-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1396-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1396-58-0x0000000000406CAE-mapping.dmp

Download
memory/1396-60-0x0000000000402000-0x0000000000406E00-memory.dmp

Filesize
19KB

Download
memory/1396-61-0x0000000000402000-0x0000000000406E00-memory.dmp

Filesize
19KB

Download
memory/1396-63-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads