6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f

General

Target

6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f.dll
Size

140KB
MD5

11ece72810c171174bf523e8a6d3d7ee
SHA1

e8f224fc3f34758bec69249dbd437a828b06fda0
SHA256

6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f
SHA512

325124b64cdb439065f161d8f342e0cd833a2f58fb021c3763cf82198e6598b178ccbb45f9d5f31f74bc303b9a0da17dbece68c6edacf32b53cce92c56ae371c
SSDEEP

3072:MtR1csuBZgfAZoHd3O5pwHtZ48U11rF3:MtDVXfWJwr4t1r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 43 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000d556174710204c6f63616c00380008000400efbed5563045d55617472a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000d5568750100041646d696e00380008000400efbed5563045d55687502a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = 5a00310000000000dd56579c10204d55504f41537e310000420008000400efbedd56579cdd56579c2a000000364101000000080000000000000000000000000000006d00550050006f0041007300760052007a007600000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000d5563045122041707044617461003c0008000400efbed5563045d55630452a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5a00310000000000dd56579c10204d55504f41537e310000420008000400efbedd56579cdd56579c2a000000483a010000000a0000000000000000000000000000006d00550050006f0041007300760052007a007600000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000d55630451100557365727300600008000400efbeee3a851ad55630452a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000dd56579c102054656d700000360008000400efbed5563045dd56579c2a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1306246566-3334493410-3785284834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

684 explorer.exe

pid	process
684	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1040 wrote to memory of 1204	1040	rundll32.exe	rundll32.exe
PID 1204 wrote to memory of 920	1204	rundll32.exe	explorer.exe
PID 1204 wrote to memory of 920	1204	rundll32.exe	explorer.exe
PID 1204 wrote to memory of 920	1204	rundll32.exe	explorer.exe
PID 1204 wrote to memory of 920	1204	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv
3⤵
PID:920

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv\mUPoAsvRzv1.lnk

Filesize
1KB

MD5
973c5ce9a2eba738e511eebd8821b092

SHA1
efff4c738855c1bb2246b20ee067825c473e6239

SHA256
b4cdec4053140465edfc14d456482e582aee2a09bbbee5ffa84bc868485351eb

SHA512
e99589f0c927f7271bd309c7cd9eb44859fe66fe72b491b9ece4f1da8c9570c58aab4cf1ae2bb09ce19e6bc474b8ba8df6e9db9ed071ac93c20708d1005fff0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv\mUPoAsvRzv2.lnk

Filesize
1KB

MD5
973c5ce9a2eba738e511eebd8821b092

SHA1
efff4c738855c1bb2246b20ee067825c473e6239

SHA256
b4cdec4053140465edfc14d456482e582aee2a09bbbee5ffa84bc868485351eb

SHA512
e99589f0c927f7271bd309c7cd9eb44859fe66fe72b491b9ece4f1da8c9570c58aab4cf1ae2bb09ce19e6bc474b8ba8df6e9db9ed071ac93c20708d1005fff0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv\mUPoAsvRzv3.lnk

Filesize
1KB

MD5
973c5ce9a2eba738e511eebd8821b092

SHA1
efff4c738855c1bb2246b20ee067825c473e6239

SHA256
b4cdec4053140465edfc14d456482e582aee2a09bbbee5ffa84bc868485351eb

SHA512
e99589f0c927f7271bd309c7cd9eb44859fe66fe72b491b9ece4f1da8c9570c58aab4cf1ae2bb09ce19e6bc474b8ba8df6e9db9ed071ac93c20708d1005fff0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv\mUPoAsvRzv4.lnk

Filesize
1KB

MD5
973c5ce9a2eba738e511eebd8821b092

SHA1
efff4c738855c1bb2246b20ee067825c473e6239

SHA256
b4cdec4053140465edfc14d456482e582aee2a09bbbee5ffa84bc868485351eb

SHA512
e99589f0c927f7271bd309c7cd9eb44859fe66fe72b491b9ece4f1da8c9570c58aab4cf1ae2bb09ce19e6bc474b8ba8df6e9db9ed071ac93c20708d1005fff0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv\mUPoAsvRzv5.lnk

Filesize
1KB

MD5
973c5ce9a2eba738e511eebd8821b092

SHA1
efff4c738855c1bb2246b20ee067825c473e6239

SHA256
b4cdec4053140465edfc14d456482e582aee2a09bbbee5ffa84bc868485351eb

SHA512
e99589f0c927f7271bd309c7cd9eb44859fe66fe72b491b9ece4f1da8c9570c58aab4cf1ae2bb09ce19e6bc474b8ba8df6e9db9ed071ac93c20708d1005fff0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mUPoAsvRzv\mUPoAsvRzv\mUPoAsvRzv5.lnk

Filesize
1KB

MD5
973c5ce9a2eba738e511eebd8821b092

SHA1
efff4c738855c1bb2246b20ee067825c473e6239

SHA256
b4cdec4053140465edfc14d456482e582aee2a09bbbee5ffa84bc868485351eb

SHA512
e99589f0c927f7271bd309c7cd9eb44859fe66fe72b491b9ece4f1da8c9570c58aab4cf1ae2bb09ce19e6bc474b8ba8df6e9db9ed071ac93c20708d1005fff0b

Download Submit
memory/684-59-0x0000000003940000-0x0000000003950000-memory.dmp

Filesize
64KB

Download
memory/684-65-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download
memory/684-66-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads