9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33

General

Target

9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe
Size

45KB
MD5

6301a7424edddfe42912f1a6ff6c9211
SHA1

0259d08690cb41cee0858798809ac14c40040153
SHA256

9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33
SHA512

37c578ff5d25b6f99290b092168917ebdcf2a6c817aa114c47ae06e52b61331d95a59dbf2147820d6caa20db2a3ef0fc1d6a2778fadc3e8e2d8a920d3630c2c3
SSDEEP

768:NGW3QtraAwusc9PvkkfvsOtzhzeAvFwuqjOQ+tykl26bXQM3iJcnPZ:NTsWAVsc935fdzhzXvLSN+t95RPZ

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Windows\\system32\\ini.exe"	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe

Loads dropped DLL 2 IoCs

pid	Process
4860	IEXPLORE.EXE
4860	IEXPLORE.EXE

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0060.DLL.N	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe
File opened for modification	C:\Windows\SysWOW64\0060.DLL.N	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe
File created	C:\Windows\SysWOW64\ini.exe	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe
File opened for modification	C:\Windows\SysWOW64\ini.exe	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001579"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377368529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3983295448"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001579"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3983295448"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0B70F4E1-77DF-11ED-89AC-F6A3911CAFFB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4548	iexplore.exe
4548	iexplore.exe
4860	IEXPLORE.EXE
4860	IEXPLORE.EXE
4860	IEXPLORE.EXE
4860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 4548	920	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe	79
PID 920 wrote to memory of 4548	920	9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe	79
PID 4548 wrote to memory of 4860	4548	iexplore.exe	80
PID 4548 wrote to memory of 4860	4548	iexplore.exe	80
PID 4548 wrote to memory of 4860	4548	iexplore.exe	80

C:\Users\Admin\AppData\Local\Temp\9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe
"C:\Users\Admin\AppData\Local\Temp\9da1ea3405be51920cd8064a3bef1f4dc9b75fb4159f9f747b1d88dd975b0a33.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:17410 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\0060.DLL.N

Filesize
37KB

MD5
22f73342497714535541ec941d1acbe5

SHA1
a8ea6ae446a980091b17b4aa1ecf9af8976ddbf0

SHA256
db269fbcee451f7156f24410d289fb8367c51744a88caee8bcf72b13bd4fdffa

SHA512
7dc6db8c767ba081a40663e70e16939fad11c75837146cac228124b765227a355db36237ed49ae8c174241eb5b9bf357d858c99a7b90958f4ccf7fae0acf01fd

Download Submit
C:\Windows\SysWOW64\0060.DLL.N

Filesize
37KB

MD5
22f73342497714535541ec941d1acbe5

SHA1
a8ea6ae446a980091b17b4aa1ecf9af8976ddbf0

SHA256
db269fbcee451f7156f24410d289fb8367c51744a88caee8bcf72b13bd4fdffa

SHA512
7dc6db8c767ba081a40663e70e16939fad11c75837146cac228124b765227a355db36237ed49ae8c174241eb5b9bf357d858c99a7b90958f4ccf7fae0acf01fd

Download Submit
C:\Windows\SysWOW64\0060.DLL.N

Filesize
37KB

MD5
22f73342497714535541ec941d1acbe5

SHA1
a8ea6ae446a980091b17b4aa1ecf9af8976ddbf0

SHA256
db269fbcee451f7156f24410d289fb8367c51744a88caee8bcf72b13bd4fdffa

SHA512
7dc6db8c767ba081a40663e70e16939fad11c75837146cac228124b765227a355db36237ed49ae8c174241eb5b9bf357d858c99a7b90958f4ccf7fae0acf01fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads