90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118

Analysis

max time kernel
77s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe
Size

436KB
MD5

2b6f83b27b4fed3facced912e1e3a3e4
SHA1

ece97cfb025aac9ba09f1df8923d89987999935e
SHA256

90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118
SHA512

2c3a0923c908ce8e743ccd1c7db8fd54fddbcd5255aa2772eaa01456b98317076024e397f557f5ce41434ba837f24266858b4079b2b80ad838e9201da7ed1c6e
SSDEEP

6144:7fbDK9TMEBjMO5npwdK/1ZmYvUkbxcRb4GYT6Q28sb0Ro+kH0qdNvL537JG2xmGy:7K9TMqMOojb4fX2YMnrvLB7QHpT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3276	scvhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\scvhost.exe	cmd.exe
File opened for modification	C:\Windows\scvhost.exe	cmd.exe

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wardom.org\Total = "32"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "983141941"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\wardom.org	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ae2e2ca909d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6615BFA4-759C-11ED-A0EE-5E349B7DFDEC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000203d8bac92ae0245bd38f4ee789b343c000000000200000000001066000000010000200000001c027791bd04f2133565c411c19d5ae0831cbf3506eb1a303ad379c51fb66efa000000000e8000000002000020000000b31919efb3e3fd1a8aae6fd354f2edebef5f65b77e0d0c31e7ae7be9e2dff8162000000090be7ae1c39ece12ec237ac134bfc24344e505dd304ac1aad8432cad00d004054000000054cae170683a48c317dc65436ec0d0baa3d5111dac99b24f4ace351c425afdfebfa59771f0d6257f86718199e8d0b515644ad51dc84ac77bd41a8bb5218983e2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001001"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wardom.org\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.wardom.org\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "989234115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wardom.org	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.wardom.org	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "983141941"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377119985"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe
Token: SeIncBasePriorityPrivilege	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe
Token: SeIncBasePriorityPrivilege	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
400	IEXPLORE.EXE
400	IEXPLORE.EXE
400	IEXPLORE.EXE
400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 2320	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	82
PID 920 wrote to memory of 2320	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	82
PID 920 wrote to memory of 2320	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	82
PID 920 wrote to memory of 3276	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	84
PID 920 wrote to memory of 3276	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	84
PID 920 wrote to memory of 3276	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	84
PID 920 wrote to memory of 740	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	86
PID 920 wrote to memory of 740	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	86
PID 920 wrote to memory of 740	920	90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe	86
PID 2524 wrote to memory of 400	2524	iexplore.exe	89
PID 2524 wrote to memory of 400	2524	iexplore.exe	89
PID 2524 wrote to memory of 400	2524	iexplore.exe	89

C:\Users\Admin\AppData\Local\Temp\90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe
"C:\Users\Admin\AppData\Local\Temp\90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy "C:\Users\Admin\AppData\Local\Temp\90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118.exe" "C:\Windows\scvhost.exe"
  2⤵
  - Drops file in Windows directory
  PID:2320
- C:\Windows\scvhost.exe
  C:\Windows\scvhost.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c delme.bat
  2⤵
  PID:740

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f8f8086f87156d14091b152fcaadc3ce

SHA1
fe3cfbf9e2e871c948300473593dfcf189013386

SHA256
8d92f28b70ed5265fafad8b37ce049b0b8ecad038745173acc35a21b8222bf56

SHA512
1235be77513694a1478459e999631920be42183a6993dc1f93333831eaa54ea60c7d8617029289c95fed2f861fc7aa79da551c128df4428d23752044eb68ba7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
8864e3b8d19c36b6010b8fb4dcf80e71

SHA1
8bf05496e954011cd47cd4757520a86c0be68bc6

SHA256
467e1ee096e4bc2280e4ee65c16714bb02c0777a713dd6e81fead09a229b5678

SHA512
9cca4fef6a634d0ba5adfab030535a3f3276108003a35008ea8d0a1bb85e84478a3080e1fb078c04fd49a4aa6f9e654e28cb4908ab5e486b88f5735e088f3c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat

Filesize
1KB

MD5
3e8820011d8d59943af1024fa87d0b06

SHA1
dcfb0e0472096f6bec403dbcdb83ca4235f1cbf0

SHA256
cfa5752f11273e0e2145cd57869362abe816508a9e17de05f66dbf9526c30c9c

SHA512
3a37f2ebe25f0e2d57389d50aac68d4e36c3004ccb8206f4347fbeea793e914cfe642614af0824ab5af4b87348b22217b3df2c9ec1c0fdc6da6f29f23a2ea872

Download Submit
C:\Users\Admin\AppData\Local\Temp\delme.bat

Filesize
257B

MD5
8367312de9f7ac78ae88783395b37f78

SHA1
a8f1efbc9e43961b1c16a840fe853028a21480fd

SHA256
464187b92f89354044c2305e102ac8f13d57feea058a0cbfd5a5f81026aa4f4c

SHA512
865d40c0f4d378951c0ff260e3601b1b85a94adfe4901f57473243ec8f683bb60e83051b563a14a2f1ed0b5c8fa77bca870e0efd908fb90f3912e29090115bd1

Download Submit
C:\Windows\scvhost.exe

Filesize
436KB

MD5
2b6f83b27b4fed3facced912e1e3a3e4

SHA1
ece97cfb025aac9ba09f1df8923d89987999935e

SHA256
90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118

SHA512
2c3a0923c908ce8e743ccd1c7db8fd54fddbcd5255aa2772eaa01456b98317076024e397f557f5ce41434ba837f24266858b4079b2b80ad838e9201da7ed1c6e

Download Submit
C:\Windows\scvhost.exe

Filesize
436KB

MD5
2b6f83b27b4fed3facced912e1e3a3e4

SHA1
ece97cfb025aac9ba09f1df8923d89987999935e

SHA256
90f47d6db8727eaceaa1e9588267482d9d1ead3dd0437beafa1dfe0d3d688118

SHA512
2c3a0923c908ce8e743ccd1c7db8fd54fddbcd5255aa2772eaa01456b98317076024e397f557f5ce41434ba837f24266858b4079b2b80ad838e9201da7ed1c6e

Download Submit