a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41

General

Target

a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Size

124KB
MD5

e5730c50dfe54554e1d2970f3636512c
SHA1

aed6b572d50c8ffd3768c1130d6e472299f78ecd
SHA256

a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41
SHA512

cd8e8ec8c16eb590e8dc7b7f7e7df2f701ba11bda7e3dcd72dafa2fa5f490652e8ec94477a234a528839b7d13d8a94500d10fa3f3c5a6adfc3e29d23099bd048
SSDEEP

3072:INTW9nbDSUAisMhmkskxizjeWfYEz6BD4L0Baw2erN8elP:SSpYifkYzRoAN

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
956	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet explorer\Main	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.web6699.cn"	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node\CLSID	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.web6699.cn"	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 956	1196	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe	28
PID 1196 wrote to memory of 956	1196	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe	28
PID 1196 wrote to memory of 956	1196	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe	28
PID 1196 wrote to memory of 956	1196	a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe	28

C:\Users\Admin\AppData\Local\Temp\a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe
"C:\Users\Admin\AppData\Local\Temp\a41c1af331b24a3ce87045d4147f37078349472c86b78f911a1d68723373ff41.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ywywywyw.bat
  2⤵
  - Deletes itself
  PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ywywywyw.bat

Filesize
248B

MD5
a05685406c1105cf042b2c2d279872f6

SHA1
91881fcead40f3608075bb144c683c0fc5bf6821

SHA256
0ade6b91fb0e1c56c2b1555b553a271d476c095e19c85eb86a8428838c4dd975

SHA512
31ff4c5d732280ba776a0f0337204bb5c0a61e4d3d989e5f6ba54d133cd6238b6f60b62eefa8026d9196483294f290b5418770aaf12ddcf54817424842d3071d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads