83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1

General

Target

83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Size

1.5MB
MD5

c555ff8981737e2374a66ea4793baf1f
SHA1

f137c249af9b91c0ac6ebc6d93b68290de5daeef
SHA256

83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1
SHA512

1018d22f90a57c148cf2432df934c3473efa8f9291aeffe3388449c365fcae059505e9a247328e7a33414a4e17c313404c91811e0e3aaf49ffb8881f62e23191
SSDEEP

49152:Hc//////B+1lKUK/e28U7OZhQ/dheW0VxOMHSpINM:Hc//////0BAaZhQ2ZvC

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iwxMDc\sNzgsN\jgsODJ\9	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
File created	C:\Windows\SysWOW64\WWHBQWE\d0T1JGSkZ\SVE5PVDBW\R1FrMXE=	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
File created	C:\Windows\SysWOW64\V5UkR\WRlJ\UUTJ\OVVxaRE1qk	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
File created	C:\Windows\SysWOW64\lRoXEZNRU\0wTUV\NeU1EXGRUTXdNVR	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
File created	C:\Windows\SysWOW64\wrwgKDEw\KSCjqyC\hsFxVVV\V6T1x	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
File created	C:\Windows\SysWOW64\lVVe\k9ca05\EUkVF\M0	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 3640	3068	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe	80

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\dnf01.com	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dnf01.com	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dnf01.com\NumberOfSubdomains = "1"	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.dnf01.com\ = "63"	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.dnf01.com	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\dnf01.com\Total = "63"	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3640	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
Token: SeIncBasePriorityPrivilege	3640	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3640	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
3640	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
3640	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
3640	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3640	3068	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe	80
PID 3068 wrote to memory of 3640	3068	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe	80
PID 3068 wrote to memory of 3640	3068	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe	80
PID 3068 wrote to memory of 3640	3068	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe	80
PID 3068 wrote to memory of 3640	3068	83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe	80

C:\Users\Admin\AppData\Local\Temp\83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
"C:\Users\Admin\AppData\Local\Temp\83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
  C:\Users\Admin\AppData\Local\Temp\83619fd15b4942c8f17236765ec4d9b7ea6e4dacff2d0d6c80e3a80327b1e6a1.exe
  2⤵
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3640-133-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download
memory/3640-135-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download
memory/3640-136-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download
memory/3640-137-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing