78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972

General

Target

78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe
Size

171KB
MD5

f4bb3032518e961b52fe8ec748d52b57
SHA1

36013cceefabb5bd1b3b874ff814a799bd6af612
SHA256

78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972
SHA512

ac600141b8b0eeb8dc7f30e394bb317896d806ce426500e696791ac886f7dde43b1d78c430b81fcb84eaaf64bbd8d1533e7e64f77839940d3519ac055fe16ad0
SSDEEP

3072:6F9dhYmj7zb6Vx9OunUxPR8+rv2bVJWZuAxIkgV7DsNq5Mo:k/uS7zbKUVibVJWZuAxIkwDsNR

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1176	IEXPLORE.EXE

Loads dropped DLL 5 IoCs

pid	Process
956	rundll32.exe
956	rundll32.exe
956	rundll32.exe
956	rundll32.exe
1176	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAFC93A1-7803-11ED-B4BC-4A12BD72B3C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
956	rundll32.exe
1640	iexplore.exe
1640	iexplore.exe
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE
956	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1776 wrote to memory of 956	1776	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	27
PID 1640 wrote to memory of 1512	1640	iexplore.exe	30
PID 1640 wrote to memory of 1512	1640	iexplore.exe	30
PID 1640 wrote to memory of 1512	1640	iexplore.exe	30
PID 1640 wrote to memory of 1512	1640	iexplore.exe	30
PID 1640 wrote to memory of 1176	1640	iexplore.exe	31
PID 1640 wrote to memory of 1176	1640	iexplore.exe	31
PID 1640 wrote to memory of 1176	1640	iexplore.exe	31
PID 1640 wrote to memory of 1176	1640	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe
"C:\Users\Admin\AppData\Local\Temp\78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\vcmsoc.dll",ReplaceChars
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275461 /prefetch:2
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\vcmsoc.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
\Users\Admin\AppData\Roaming\vcmsoc.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
\Users\Admin\AppData\Roaming\vcmsoc.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
\Users\Admin\AppData\Roaming\vcmsoc.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
\Users\Admin\AppData\Roaming\vcmsoc.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
\Users\Admin\AppData\Roaming\vcmsoc.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
memory/956-69-0x00000000001A0000-0x00000000001CD000-memory.dmp

Filesize
180KB

Download
memory/956-73-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/1776-60-0x00000000002B0000-0x00000000002C4000-memory.dmp

Filesize
80KB

Download
memory/1776-56-0x00000000002D0000-0x00000000002FD000-memory.dmp

Filesize
180KB

Download
memory/1776-55-0x00000000002B0000-0x00000000002C4000-memory.dmp

Filesize
80KB

Download
memory/1776-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing