edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1

General

Target

edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe
Size

1.4MB
MD5

fe61b30a71369fae49939b595631ff47
SHA1

c6c23ffafa68c73e28dc3cde9f7033f15095489b
SHA256

edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1
SHA512

1c1995b6b36562cc1d1513d8b4cd791ce9a19803633a210171770dbd2056726d7628fdf79cc314f9abfeb9d101875c5ed28ee6144d3f2da8d6863e558928843c
SSDEEP

24576:Hq+0QyI6VmrEGNLVV4mpeCNRcg7KD5120nfhiadM2Ob0JC9c+e4JsVBw2qbyuzN:jryI8GNxL1J7i20nfhiJ2Ool+e9ViFdN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0D60EB2F-78DE-11ED-B696-5ECC372795C7} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f3ecedea0cd901	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027e8facf21fae549856c4dfab926243e000000000200000000001066000000010000200000006cb75ca0e2c38c9ee1f1020a3d648729dc0850f3ccb6212593f1f015ddb6d205000000000e8000000002000020000000c2b3555fdb8947b8b862c8dec8d2e2ec5957786e867254db28a71d8221266e4620000000ed99ddd5c21a4e0540ccf50d1491dfe46929954db62519aeff406c9cb66464d8400000007dea5c84271cae5d98662785750f4a92c5ae9976f2d5d795af1964abcc9ae7951e29ab4889dfaef03032f93074ed13853c9fc9e5a44da8dcf4e75f411a307576	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200b38f2ea0cd901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027e8facf21fae549856c4dfab926243e00000000020000000000106600000001000020000000ae843db572f315f69279abe0406eb1b78dd55671d708d05fcfee1841c6b82cd8000000000e8000000002000020000000ddd868fc1188d6c667a34bc54755d00eb92c096c9d8c6e6ae7d7b15b6a7f4e4620000000e3f8b75d8bb5641725becc8fdcf0be749ea58d787d50270d266a681560620aba4000000041335d723ee0e6e6d10be94fe33997e501af8b9cc85a28fa742acf00bc6a3b4ed7c3332bfc070d392d688e4a588f56994d27b277b662fc50782b301bca7bf33c	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377478044"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4644	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
372	IEXPLORE.EXE
372	IEXPLORE.EXE
372	IEXPLORE.EXE
372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2728	4644	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe	79
PID 4644 wrote to memory of 2728	4644	edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe	79
PID 2728 wrote to memory of 372	2728	IEXPLORE.EXE	80
PID 2728 wrote to memory of 372	2728	IEXPLORE.EXE	80
PID 2728 wrote to memory of 372	2728	IEXPLORE.EXE	80

C:\Users\Admin\AppData\Local\Temp\edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe
"C:\Users\Admin\AppData\Local\Temp\edd7837a1f29ca659aa646c9677e250eb588a4753d8f29d98fe0a19c00727ed1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.a585.com/?down
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4644-134-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/4644-135-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing