c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be

General

Target

c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe
Size

174KB
MD5

ae140d3c6cb890ab4da8097db69cf751
SHA1

5f9ef857668948d3b2c7fe00babdaa65d9489cbe
SHA256

c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be
SHA512

87e7db4fe05bc97353f0837a92f957b601c291f359caa20ee493c334b0b0c82238ddbb496752f8b380ffbfe37c5ba81d572815e1ae119480f628c36f6451a0b8
SSDEEP

3072:O3hajomxy4l41KAdnrkEwQZnm2TchyqvYCdShifdzExbf:ORajo34l4tBn8YolExb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
912	IEXPLORE.EXE

Loads dropped DLL 5 IoCs

pid	Process
1160	rundll32.exe
1160	rundll32.exe
1160	rundll32.exe
1160	rundll32.exe
912	IEXPLORE.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apeyp = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\apeyp.dll\",GenerateUniqueFileName"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72C66481-752D-11ED-8641-5263E908E3CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1516	iexplore.exe
1516	iexplore.exe
952	IEXPLORE.EXE
952	IEXPLORE.EXE
1160	rundll32.exe
1516	iexplore.exe
1516	iexplore.exe
912	IEXPLORE.EXE
912	IEXPLORE.EXE
1160	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 756 wrote to memory of 1160	756	c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe	28
PID 1516 wrote to memory of 952	1516	iexplore.exe	31
PID 1516 wrote to memory of 952	1516	iexplore.exe	31
PID 1516 wrote to memory of 952	1516	iexplore.exe	31
PID 1516 wrote to memory of 952	1516	iexplore.exe	31
PID 1516 wrote to memory of 912	1516	iexplore.exe	32
PID 1516 wrote to memory of 912	1516	iexplore.exe	32
PID 1516 wrote to memory of 912	1516	iexplore.exe	32
PID 1516 wrote to memory of 912	1516	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe
"C:\Users\Admin\AppData\Local\Temp\c299b4e5748d32e15714128e109134c1fa0ce57622a2a7bbae5395f6809637be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\apeyp.dll",GenerateUniqueFileName
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1160

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275461 /prefetch:2
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\apeyp.dll

Filesize
174KB

MD5
de78b944692da4dea7cc1dcbb6a49b11

SHA1
ba957ec007388fde541ecc1bd8a8a6684f0b3adb

SHA256
ad62cfa3a216a1252cedb20e45da9ce551e0d8c8cebd08f8cc3622826d022f8d

SHA512
6c8a9d4a0ee7e62fbd130b5d9da3af332c025632c09e117dcc06a1bbcc08fe29eaf38ffdca780ac8fc59b9469cf26e430984dc00f7f395bda83478d90838eb74

Download Submit
\Users\Admin\AppData\Roaming\apeyp.dll

Filesize
174KB

MD5
de78b944692da4dea7cc1dcbb6a49b11

SHA1
ba957ec007388fde541ecc1bd8a8a6684f0b3adb

SHA256
ad62cfa3a216a1252cedb20e45da9ce551e0d8c8cebd08f8cc3622826d022f8d

SHA512
6c8a9d4a0ee7e62fbd130b5d9da3af332c025632c09e117dcc06a1bbcc08fe29eaf38ffdca780ac8fc59b9469cf26e430984dc00f7f395bda83478d90838eb74

Download Submit
\Users\Admin\AppData\Roaming\apeyp.dll

Filesize
174KB

MD5
de78b944692da4dea7cc1dcbb6a49b11

SHA1
ba957ec007388fde541ecc1bd8a8a6684f0b3adb

SHA256
ad62cfa3a216a1252cedb20e45da9ce551e0d8c8cebd08f8cc3622826d022f8d

SHA512
6c8a9d4a0ee7e62fbd130b5d9da3af332c025632c09e117dcc06a1bbcc08fe29eaf38ffdca780ac8fc59b9469cf26e430984dc00f7f395bda83478d90838eb74

Download Submit
\Users\Admin\AppData\Roaming\apeyp.dll

Filesize
174KB

MD5
de78b944692da4dea7cc1dcbb6a49b11

SHA1
ba957ec007388fde541ecc1bd8a8a6684f0b3adb

SHA256
ad62cfa3a216a1252cedb20e45da9ce551e0d8c8cebd08f8cc3622826d022f8d

SHA512
6c8a9d4a0ee7e62fbd130b5d9da3af332c025632c09e117dcc06a1bbcc08fe29eaf38ffdca780ac8fc59b9469cf26e430984dc00f7f395bda83478d90838eb74

Download Submit
\Users\Admin\AppData\Roaming\apeyp.dll

Filesize
174KB

MD5
de78b944692da4dea7cc1dcbb6a49b11

SHA1
ba957ec007388fde541ecc1bd8a8a6684f0b3adb

SHA256
ad62cfa3a216a1252cedb20e45da9ce551e0d8c8cebd08f8cc3622826d022f8d

SHA512
6c8a9d4a0ee7e62fbd130b5d9da3af332c025632c09e117dcc06a1bbcc08fe29eaf38ffdca780ac8fc59b9469cf26e430984dc00f7f395bda83478d90838eb74

Download Submit
\Users\Admin\AppData\Roaming\apeyp.dll

Filesize
174KB

MD5
de78b944692da4dea7cc1dcbb6a49b11

SHA1
ba957ec007388fde541ecc1bd8a8a6684f0b3adb

SHA256
ad62cfa3a216a1252cedb20e45da9ce551e0d8c8cebd08f8cc3622826d022f8d

SHA512
6c8a9d4a0ee7e62fbd130b5d9da3af332c025632c09e117dcc06a1bbcc08fe29eaf38ffdca780ac8fc59b9469cf26e430984dc00f7f395bda83478d90838eb74

Download Submit
memory/756-60-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/756-56-0x0000000000290000-0x00000000002BF000-memory.dmp

Filesize
188KB

Download
memory/756-55-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/756-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/1160-69-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/1160-73-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads