1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703

General

Target

1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Size

2.6MB
MD5

073a987315ab40e571fc5dd55ac8b976
SHA1

a54d30bc55ff30649c6afa78a8b58ea84dd88123
SHA256

1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703
SHA512

6d8ab7a90c86c91f357d5b7a7d1cf2a582be08b66f8f7153533b37e8c33ccbb5b9b26df365f0f880530e86b974f09d198cb803cd570bed62a76d7cf21aebbe5b
SSDEEP

49152:dukwYuIrMlSBip4TZaqdwk0c05HGid+s8KuqGaX0ToIBAUZLYK:UBYlZBip4YqdwkLcHHWJBAUZLB

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0001000000022f28-134.dat	acprotect
behavioral2/files/0x0001000000022f28-133.dat	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000022f28-134.dat	upx
behavioral2/files/0x0001000000022f28-133.dat	upx
behavioral2/memory/4972-135-0x00000000114D0000-0x000000001150D000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.4399.com\ = "126"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\4399.com\Total = "63"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\4399.com	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\4399.com\NumberOfSubdomains = "1"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.4399.com\ = "63"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\4399.com\Total = "126"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = a803000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.4399.com	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
4972	1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe

C:\Users\Admin\AppData\Local\Temp\1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe
"C:\Users\Admin\AppData\Local\Temp\1e439f14f3193e0846c5d35d4a066117e065759a7eecdc840347aba37d67a703.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/4972-135-0x00000000114D0000-0x000000001150D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing