b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449

General

Target

b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe
Size

1.1MB
MD5

39ecc70c2d2baf144d81c8a8c930c064
SHA1

bd2313bed774d4804de7e2ce65a9820c81a91c73
SHA256

b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449
SHA512

bb8a79f8336b8de9150bc59274bd762a20eee2a900a1592e6f87bd18a32af0f3f359e556549016ec67fb701d082440c8d76b9ec9196dffa839e358912fd2e8a9
SSDEEP

24576:PC7I14/6ZNetmSwfC7lZwhgppoud4UvMt:qk7Md

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

win34.exe

pid process

888 win34.exe

pid	process
888	win34.exe

Loads dropped DLL 2 IoCs

Processes:

b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe

pid	process
956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe
956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\runAPI74 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runAPI45.exe\""	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe

description pid process target process

PID 956 set thread context of 888 956 b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe win34.exe

description	pid	process	target process
PID 956 set thread context of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000571d947ef87a2dafefa6588a658d701210b693f6b58e54b59137c3393b01ceff000000000e80000000020000200000004db53ccf4de67779d1d7a2c140486c6144ac2e621b84a2f6d7af0bfb55c8008c2000000039d21301971b4f3eb94129a2b77ec25af92d0a237ce166c407a5ed4fc581df094000000064e1ea5f5f47998487958944a1dc73fec6f83e49cfc60e09ecbfa3a48546e06e42f8e99b652ab3c5131a1880737b88c2156c8a9b853c4bfb9f34cdd6239fcd31	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000003595fa6201b484dc8fa2218ca62131847948b3125603878c18dc85907d242141000000000e80000000020000200000008f4fe3004fb712835e986732b8ddfe82c3788a2e221b7aaf90019fbea3dbc00190000000b8e6bb4180e2d4a40da04f274d02c7832d6f946d6dee46315420bd76e1edd7cebb90eb0ef07ab0082ff682f257a3faa7abbbd02f698788a4ce821e7700880329f1ed191718778a409e0852a7b7d4100cebd83151b542bf47df19a301b30a96e4d87595127456be32ad64c9fe90ceec41a0d0f7e0800a45475b69a9882aeb49682134d9b1a2afee55b7c1b6544312562b4000000032195a155e647aaab2b430efffc12a35cff3440234d8762673f66d089a0fb44efd7eb60e01742ceda6e189887821f9888451c39b682eaa5144f5ae2447fcb21d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01618358b07d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A0F5DE0-737E-11ED-AFC0-6662AD81E03A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376887153"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

276 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

276 iexplore.exe
276 iexplore.exe
912 IEXPLORE.EXE
912 IEXPLORE.EXE
912 IEXPLORE.EXE
912 IEXPLORE.EXE

pid	process
276	iexplore.exe

pid	process
276	iexplore.exe
276	iexplore.exe
912	IEXPLORE.EXE
912	IEXPLORE.EXE
912	IEXPLORE.EXE
912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exewin34.exeiexplore.exe

description	pid	process	target process
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 956 wrote to memory of 888	956	b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe	win34.exe
PID 888 wrote to memory of 276	888	win34.exe	iexplore.exe
PID 888 wrote to memory of 276	888	win34.exe	iexplore.exe
PID 888 wrote to memory of 276	888	win34.exe	iexplore.exe
PID 888 wrote to memory of 276	888	win34.exe	iexplore.exe
PID 276 wrote to memory of 912	276	iexplore.exe	IEXPLORE.EXE
PID 276 wrote to memory of 912	276	iexplore.exe	IEXPLORE.EXE
PID 276 wrote to memory of 912	276	iexplore.exe	IEXPLORE.EXE
PID 276 wrote to memory of 912	276	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe
"C:\Users\Admin\AppData\Local\Temp\b52230ba0750810d362bf8f58f0332eec710ce0e6b61fd89b68d0dc108f53449.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\win34.exe
C:\Users\Admin\AppData\Local\Temp\win34.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=win34.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:276 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\win34.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\win34.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BAPYICQA.txt

Filesize
533B

MD5
6484c5f9e7a22a9218624eb4c489b8dc

SHA1
516cdc6ce161ca1b7f29550fe7c1b697c0ed63d0

SHA256
541bbe8f4227d5f051409903d12fac2a62dd4f56411552ca9b613916e533355c

SHA512
dfa70900aa5849761fa25bdf4240af0d362955aabe2f235dbc7effe0f8f0f0e167151c871858d67ee7159db85135ab45fdeb2aea27f61d45866ed1d41dfe3385

Download Submit
\Users\Admin\AppData\Local\Temp\win34.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
\Users\Admin\AppData\Local\Temp\win34.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
memory/888-58-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/888-61-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/888-62-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/888-63-0x00000000004C040E-mapping.dmp

Download
memory/888-60-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/888-66-0x0000000000402000-0x00000000004C1000-memory.dmp

Filesize
764KB

Download
memory/888-67-0x0000000000402000-0x00000000004C1000-memory.dmp

Filesize
764KB

Download
memory/888-57-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/956-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/956-69-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download
memory/956-71-0x0000000074510000-0x0000000074ABB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads