b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9

Analysis

max time kernel
126s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
Size

141KB
MD5

0b4f1c6cf4d6b067e755b9ae6b52ef3c
SHA1

baab65b9695f7ab634f157181ddd660d555c3bc0
SHA256

b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9
SHA512

6caf71bdc12ee7cc725ce7aef6fb48abd1e53161155d4cf1b4e1cb0186f2c09dbc2af148559f6b020a9e6e0bf6c7c5bd0fa57eb3a2ad2885549ca061f0508c2b
SSDEEP

3072:Utx8XWWqZGLuSX/y/32XZrXMaDTOZvKcctI:ukWKLuSv232VXMaHmva

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDEC3271-77BC-11ED-85E0-FE41811C61F5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01bf5d6c90bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073a5321d9e5fb845ac11b0fc550a9e4c0000000002000000000010660000000100002000000024f955ba06a1cdea7b5f55453cb17837cfd7cb8018ef20e706cf5b833ca27821000000000e80000000020000200000002646df9cc2b2f742f4e5cce3d978843eeb2fdb244e81510dbbe96d4de0cecd9e900000006b66b26b271b0cff4c108c650045c991b80fcd7116b39d7d3becafebcba2e95d4974f1bb24015a294d7407e1ce165e21a372ed9cbe51091ad94d9041ae56da07b54b6b0f4eae2581aee0728900398dd6fede763217feaaab220ddd936d40d7db6505b1808d81a2209fc93ce09e580d9890f7264952f19693ab048713c304cafc8217c09f2d300d9b5e7db892d0b14fc64000000021b6fdc854d5809e81e05f2877da3692eff4e016ffb09269fbce56ea9fc8f8fae3f05c0c38da5a2e7df20b407b3739f979c654645e09d41214ad484a116b844f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000073a5321d9e5fb845ac11b0fc550a9e4c0000000002000000000010660000000100002000000080963b9d71e8e53b6df261e9e661eba9f83f26437e1869d2029fa39f9e6cf42c000000000e80000000020000200000003310febed4197c70210c8cb2e8876efbb79db946db0a2b5bca96b43861e756262000000010d95457563cb76b0c152ac58416b77acd71c30b1a253aa42f37af3a4b46dfb740000000854e96ac70fcb4d74a33c206d8d451d548d83f7b0906357da616e8167df2955c88700a999202c7f186ce6761bf07be4c4bca4c78c40868eb1a67c7e67924e4a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377353861"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1552	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1688	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
1552	iexplore.exe
1552	iexplore.exe
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1552	1688	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe	27
PID 1688 wrote to memory of 1552	1688	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe	27
PID 1688 wrote to memory of 1552	1688	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe	27
PID 1688 wrote to memory of 1552	1688	b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe	27
PID 1552 wrote to memory of 268	1552	iexplore.exe	29
PID 1552 wrote to memory of 268	1552	iexplore.exe	29
PID 1552 wrote to memory of 268	1552	iexplore.exe	29
PID 1552 wrote to memory of 268	1552	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe
"C:\Users\Admin\AppData\Local\Temp\b69a22349d55c321aa72831d804b28c6ef364d38f783acb5fa601db6309a65b9.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=vsd3g0h_vs0
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
fadba13e0020528b5b7dfa27b8350814

SHA1
c59a2f117cf762c5e192af3aa956f1b3eb2eb0b5

SHA256
518451989f1725b3ec9954c6aef871299f731c6010a53ad7fad4ea036f7eedce

SHA512
70f436488aced3d06268c5cc4b4929a3aeda49243acca8f46c32a89a7998114e0d69863b12b5f4729d4cd4e6f3658c7bb8154a9fc6ae03dbe30783037aa51337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

Filesize
5KB

MD5
b7581f6b7d7d5d489fd9fc086615d8df

SHA1
3b93abd0f8b88a7dca9c05d5701c7fb1c2fd9cf3

SHA256
6a41243cf2e991c0995f8a28cb34e23a697cfc71f752fc6f456c35ccc816dc8b

SHA512
e0c7620bd8c1d3753111212dc2d43afab7f7d81e157e145bede4acbcfba8b4aa04bc942f3b4dcb356c3a7953d73eac7dcacdb025970b282f9dac5e08a2ae00e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BG9XQTG0\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LKK7J3DI.txt

Filesize
603B

MD5
dcbfdcb53a6ff8245199d71c76d4333b

SHA1
226174e6f593914149026f54532db2fa65a9e11d

SHA256
9678de171363420837e0aecac157986c55c0a04b7db91331d3b2a19b2deb0371

SHA512
4fa648089f6be9cc2e63b5b5d924608af154ebeea38f5c5afc45daa89d2b69d039fd3988a10d6d96d5eb683f70592c00bbc0e9228feebc119ab716fa0abf920d

Download Submit
memory/1688-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1688-55-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download
memory/1688-58-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1688-60-0x0000000003250000-0x0000000003D0A000-memory.dmp

Filesize
10.7MB

Download
memory/1688-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1688-62-0x00000000004E0000-0x0000000000526000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads