78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972

General

Target

78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe
Size

171KB
MD5

f4bb3032518e961b52fe8ec748d52b57
SHA1

36013cceefabb5bd1b3b874ff814a799bd6af612
SHA256

78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972
SHA512

ac600141b8b0eeb8dc7f30e394bb317896d806ce426500e696791ac886f7dde43b1d78c430b81fcb84eaaf64bbd8d1533e7e64f77839940d3519ac055fe16ad0
SSDEEP

3072:6F9dhYmj7zb6Vx9OunUxPR8+rv2bVJWZuAxIkgV7DsNq5Mo:k/uS7zbKUVibVJWZuAxIkwDsNR

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3616	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpcner = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\wpcner.dll\",ReplaceChars"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1391077291"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001616"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1391077291"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001616"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{688AB13F-7803-11ED-BF5F-DE9E83FE850F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4080	iexplore.exe
4080	iexplore.exe
4080	iexplore.exe
4080	iexplore.exe
4080	iexplore.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4080	iexplore.exe
4080	iexplore.exe
2460	IEXPLORE.EXE
2460	IEXPLORE.EXE
3616	rundll32.exe
4080	iexplore.exe
4080	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
3616	rundll32.exe
4080	iexplore.exe
4080	iexplore.exe
64	IEXPLORE.EXE
64	IEXPLORE.EXE
3616	rundll32.exe
4080	iexplore.exe
4080	iexplore.exe
1456	IEXPLORE.EXE
1456	IEXPLORE.EXE
3616	rundll32.exe
4080	iexplore.exe
4080	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
3616	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3616	1044	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	84
PID 1044 wrote to memory of 3616	1044	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	84
PID 1044 wrote to memory of 3616	1044	78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe	84
PID 4080 wrote to memory of 2460	4080	iexplore.exe	89
PID 4080 wrote to memory of 2460	4080	iexplore.exe	89
PID 4080 wrote to memory of 2460	4080	iexplore.exe	89
PID 4080 wrote to memory of 2744	4080	iexplore.exe	90
PID 4080 wrote to memory of 2744	4080	iexplore.exe	90
PID 4080 wrote to memory of 2744	4080	iexplore.exe	90
PID 4080 wrote to memory of 64	4080	iexplore.exe	92
PID 4080 wrote to memory of 64	4080	iexplore.exe	92
PID 4080 wrote to memory of 64	4080	iexplore.exe	92
PID 4080 wrote to memory of 1456	4080	iexplore.exe	95
PID 4080 wrote to memory of 1456	4080	iexplore.exe	95
PID 4080 wrote to memory of 1456	4080	iexplore.exe	95

C:\Users\Admin\AppData\Local\Temp\78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe
"C:\Users\Admin\AppData\Local\Temp\78ce50361ad70e8824af59de0cb9deaf0d749091420a268f70d778b22db6e972.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\wpcner.dll",ReplaceChars
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:3616

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1412

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:17414 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:82948 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:64
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4080 CREDAT:82952 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wpcner.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
C:\Users\Admin\AppData\Roaming\wpcner.dll

Filesize
171KB

MD5
dd2bb3298a47e030f947fa35c05b53e3

SHA1
ae5f477b486588507663dea9e64ca7197c16dd12

SHA256
9aed3ca3c9e81020db98c056db2fce934b13871a735458469f514cb5644c45c2

SHA512
ef29e2294204de92b38272ab307dc1db486b67ead8f0131c3531cdaac7b9f9c08a418a7e19c7d76a8aba2bb7d1c7cd38ce2961dba6d129148b1fd8cf441c02b8

Download Submit
memory/1044-132-0x0000000000B20000-0x0000000000B34000-memory.dmp

Filesize
80KB

Download
memory/1044-133-0x0000000002170000-0x000000000219D000-memory.dmp

Filesize
180KB

Download
memory/1044-138-0x0000000000B20000-0x0000000000B34000-memory.dmp

Filesize
80KB

Download
memory/3616-142-0x0000000002AF0000-0x0000000002B1D000-memory.dmp

Filesize
180KB

Download
memory/3616-146-0x0000000001180000-0x0000000001194000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads