7a023e2fad2a78cfd927b21153aa690781f30f0c58dc75e52c7d7fae6446fd13

General

Target

7a023e2fad2a78cfd927b21153aa690781f30f0c58dc75e52c7d7fae6446fd13.dll
Size

101KB
MD5

d4ae0cb9493e07bbde77bb341f9943f0
SHA1

2dffdcc424f4e734a2f784c7e46584738a2616f8
SHA256

7a023e2fad2a78cfd927b21153aa690781f30f0c58dc75e52c7d7fae6446fd13
SHA512

5a42861c454c05da833df776f58388fe3cb53ee7086e8048a8ce4c02aded988a32672dd128a0d1099da464105762367b8385401abf240b5e4c6787874389d078
SSDEEP

3072:XsU+S7o2ET2Xm5h0yXkyohodNfgxEHsvAEnYc+jlp:cU+SM2ETIG0yXk6Ux6svjv

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

mscorp.exe

pid process

1960 mscorp.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2036 takeown.exe
2024 icacls.exe

pid	process
1960	mscorp.exe

pid	process
2036	takeown.exe
2024	icacls.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mscorp\ImagePath = "%SystemRoot%\\System32\\spoolsv.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mscorp\ImagePath = "%SystemRoot%\\System32\\mscorp.exe"	rundll32.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2036 takeown.exe
2024 icacls.exe
Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\system32\mscorp.exe rundll32.exe
File opened for modification C:\Windows\system32\mscorp.exe rundll32.exe

pid	process
2036	takeown.exe
2024	icacls.exe

description	ioc	process
File created	C:\Windows\system32\mscorp.exe	rundll32.exe
File opened for modification	C:\Windows\system32\mscorp.exe	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000087d45100c4b3bd46a4adf63eeb2d0108000000000200000000001066000000010000200000005fe05151142b7b56a38ff2394ec937614867fc7ce128050fde9d79eba1dd0d1a000000000e8000000002000020000000637974377dcd185eb67b77719353b2ee474fb402dddc4fd328de849c48b7e63b90000000e763bebb42c868cd3e7fbe697adcc8dfff047f16d4f9cdc124d62e1b52bc877caef13e5a7cf63e2f7581699e579037ca0045341622591a043603d2eed51cc58228ab04c313e983fd2a2156ce6d1b759b4885b39b896ca81b78bbcee69215f042997f0a6cd8c228ba4a9cbc36f788af7f205b1921e1195729bf69801cee0e29475fc151d53f804c77dc253676cacde988400000005654e105e84e66f00f9d49ffa2bf187a36fbaf0df58e86957bcf2fe4eff60d0ff3031e5990972810ec03ca8f0ea26059962137f7d113bba211d287a7ea8242b3	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000087d45100c4b3bd46a4adf63eeb2d010800000000020000000000106600000001000020000000cb72f98d5a88f107cb93f8113c3bb75012c791fc2c263287e9882af1cae7683b000000000e8000000002000020000000da9f2313b5b28e848c8a3d437a990f40ef7ccdb36c1342e57ce7dd202dfa046b2000000054ef04529cc79c8b137de3d1ec5f36d5c4d106841e6fdb3f56e3fac73cacbc8a40000000f811b8cdd877bd19ab00fdebac4f61b5fee0245e19faf10df50dda361722f6615c672a3b17ace5b4560d8dddb995c3ce9f9e4cb78576a6b02ffa950a2137df0a	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381783743"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D95CDD1-A007-11ED-BB94-5A21EB137514} = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00c1cfc1334d901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1748 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1748 IEXPLORE.EXE
1748 IEXPLORE.EXE
1916 IEXPLORE.EXE
1916 IEXPLORE.EXE
1916 IEXPLORE.EXE
1916 IEXPLORE.EXE

pid	process
1748	IEXPLORE.EXE

pid	process
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

rundll32.exemscorp.execmd.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1800 wrote to memory of 1788	1800	rundll32.exe	cmd.exe
PID 1800 wrote to memory of 1788	1800	rundll32.exe	cmd.exe
PID 1800 wrote to memory of 1788	1800	rundll32.exe	cmd.exe
PID 1800 wrote to memory of 1960	1800	rundll32.exe	mscorp.exe
PID 1800 wrote to memory of 1960	1800	rundll32.exe	mscorp.exe
PID 1800 wrote to memory of 1960	1800	rundll32.exe	mscorp.exe
PID 1800 wrote to memory of 1960	1800	rundll32.exe	mscorp.exe
PID 1960 wrote to memory of 2020	1960	mscorp.exe	iexplore.exe
PID 1960 wrote to memory of 2020	1960	mscorp.exe	iexplore.exe
PID 1960 wrote to memory of 2020	1960	mscorp.exe	iexplore.exe
PID 1960 wrote to memory of 2020	1960	mscorp.exe	iexplore.exe
PID 1788 wrote to memory of 2036	1788	cmd.exe	takeown.exe
PID 1788 wrote to memory of 2036	1788	cmd.exe	takeown.exe
PID 1788 wrote to memory of 2036	1788	cmd.exe	takeown.exe
PID 2020 wrote to memory of 1748	2020	iexplore.exe	IEXPLORE.EXE
PID 2020 wrote to memory of 1748	2020	iexplore.exe	IEXPLORE.EXE
PID 2020 wrote to memory of 1748	2020	iexplore.exe	IEXPLORE.EXE
PID 2020 wrote to memory of 1748	2020	iexplore.exe	IEXPLORE.EXE
PID 1788 wrote to memory of 2024	1788	cmd.exe	icacls.exe
PID 1788 wrote to memory of 2024	1788	cmd.exe	icacls.exe
PID 1788 wrote to memory of 2024	1788	cmd.exe	icacls.exe
PID 1748 wrote to memory of 1916	1748	IEXPLORE.EXE	IEXPLORE.EXE
PID 1748 wrote to memory of 1916	1748	IEXPLORE.EXE	IEXPLORE.EXE
PID 1748 wrote to memory of 1916	1748	IEXPLORE.EXE	IEXPLORE.EXE
PID 1748 wrote to memory of 1916	1748	IEXPLORE.EXE	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a023e2fad2a78cfd927b21153aa690781f30f0c58dc75e52c7d7fae6446fd13.dll,#1
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\system32\cmd.exe
cmd.exe /c takeown /f "C:\Windows\system32\mscorp.exe" && icacls "C:\Windows\system32\mscorp.exe" /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\mscorp.exe"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2036

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\mscorp.exe" /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2024

C:\Windows\system32\mscorp.exe
C:\Windows\system32\mscorp.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960

C:\program files (x86)\Internet Explorer\iexplore.exe
"C:\program files (x86)\Internet Explorer\iexplore.exe" google.com
3⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" google.com
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
d93ee5fa9a1ce6324af9500c60125eaf

SHA1
67deb635a652bdae062b9a7cc30c4b0187a4ee4f

SHA256
d715a51867f3d9083e5f9373e8ee39e8516d4c6c7e70134f401e3167a894542e

SHA512
67835f33a868f01258246c8d99f7dc8293cff010b5025f71659972498d998f3ff22d9afae59e0702d6523dfc98f9eabe6d00d88622892c141792a4659f8ae66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat
Filesize
9KB

MD5
8e6faf6af6dd1432ec41bace5a86ac4d

SHA1
c9be0e130d79c65a6e46d9a573f0d2740b5528a8

SHA256
c7a18bceeba819b5819ac121b6a7811cd7e57fbcd4ef5d0fde70790e2215d636

SHA512
271ffb99acf6a7e6402ea98975a5c5ab5af0005148626510a7ab01a6da46f24d4d62c93985937d98871444968630587e65170ce824aee1ef01f8b0a94cd62b44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YGUL4J4Q.txt
Filesize
607B

MD5
17ba606b7923a2738668d2d67fdc9d7c

SHA1
2e4d446ccf5dca5b93f6f254e37058c2d4207ce0

SHA256
512ad964b268691eb80e2afea4f0510b8d31e4abe5549ddbb072b6d49325a68b

SHA512
664a08fdab780aaabedc180ee9c56313d9b1684bbff4147952b18bc750341198d4c35e709dec3354c4fd8ed98d57179ba95664316064925feb7e48cd69f5e25f

Download Submit
C:\Windows\System32\mscorp.exe
Filesize
28KB

MD5
7a761c26dcf4c1e3b607bb09a17a6691

SHA1
3348c59e794f19cc328ab262c2c0b57d25656d8e

SHA256
21b3ecefc540dd04a9e30d8bb8333279faef495661be9d99bbbb2cc43db8bd68

SHA512
56b2a3041c37d3a3b8f2b622aca71145dd8db0b5b8a16f8bd86170af83e683c2bc824ca8912c71ce3447152f44854e9b529fd2c79aae06910c62dc313947ef1b

Download Submit
C:\Windows\system32\mscorp.exe
Filesize
28KB

MD5
7a761c26dcf4c1e3b607bb09a17a6691

SHA1
3348c59e794f19cc328ab262c2c0b57d25656d8e

SHA256
21b3ecefc540dd04a9e30d8bb8333279faef495661be9d99bbbb2cc43db8bd68

SHA512
56b2a3041c37d3a3b8f2b622aca71145dd8db0b5b8a16f8bd86170af83e683c2bc824ca8912c71ce3447152f44854e9b529fd2c79aae06910c62dc313947ef1b

Download Submit
memory/1788-54-0x0000000000000000-mapping.dmp

Download
memory/1960-55-0x0000000000000000-mapping.dmp

Download
memory/1960-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2024-59-0x0000000000000000-mapping.dmp

Download
memory/2036-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads