22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a

Analysis

max time kernel
152s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
Size

2.5MB
MD5

10c2eaa27b20c9f6dd0f3add518cb789
SHA1

34874c9556dd9c9eb9466b6974fdd409e47a1cb7
SHA256

22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a
SHA512

a3dc22d9e10f3ff19e1d17e6eb145bc860acdf0550cbb55531f4f8bcb0c21168fb045901b8ea150ce7ec26a5d84cffda2b01ba97218cbd466334de86c5a82a4b
SSDEEP

49152:2v2GmLW0XNsRpN9TYjizKyVqHxM2qil+j5j8wB/jhT:aCW0GRf9uizKy065j8srh

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1524	EXPLEROR.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SYSTEM\EXPLEROR.EXE	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync	EXPLEROR.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	EXPLEROR.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DOMStorage\yy.com	EXPLEROR.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	EXPLEROR.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com	EXPLEROR.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com\NumberOfSubdomains = "1"	EXPLEROR.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	EXPLEROR.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	EXPLEROR.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
1524	EXPLEROR.EXE
1524	EXPLEROR.EXE
1524	EXPLEROR.EXE
1524	EXPLEROR.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1524	2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	84
PID 2836 wrote to memory of 1524	2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	84
PID 2836 wrote to memory of 1524	2836	22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe	84

C:\Users\Admin\AppData\Local\Temp\22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe
"C:\Users\Admin\AppData\Local\Temp\22481b57460a84c75bee66652ece7a69afc946f29ab252f58bedbe021f47288a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\WINDOWS\SYSTEM\EXPLEROR.EXE
  C:\WINDOWS\SYSTEM\EXPLEROR.EXE
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SYSTEM\EXPLEROR.EXE

Filesize
612KB

MD5
d4d07d767615db6757bd842161121a15

SHA1
5813e4dcc9656c874ae06a91e23f6ef4a024e090

SHA256
aa5d23db3c2496acba298a0fdf0d79a5630720ee83c6af05bc2d02370ad2296a

SHA512
575ccf52a496f484661b534716f878cd10ed73cca5a4f235d707a928a1bf7a419994e6b3e3d06d08ec9fd2d571a527d15a265c484520bf2a3b4247a2d20ad4e2

Download Submit
C:\Windows\System\EXPLEROR.EXE

Filesize
612KB

MD5
d4d07d767615db6757bd842161121a15

SHA1
5813e4dcc9656c874ae06a91e23f6ef4a024e090

SHA256
aa5d23db3c2496acba298a0fdf0d79a5630720ee83c6af05bc2d02370ad2296a

SHA512
575ccf52a496f484661b534716f878cd10ed73cca5a4f235d707a928a1bf7a419994e6b3e3d06d08ec9fd2d571a527d15a265c484520bf2a3b4247a2d20ad4e2

Download Submit