6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f

General

Target

6b1a9d76f3baa944f8570dc96.dll
Size

140KB
MD5

11ece72810c171174bf523e8a6d3d7ee
SHA1

e8f224fc3f34758bec69249dbd437a828b06fda0
SHA256

6b1a9d76f3baa944f8570dc9612fcb24c519f3cfc3098dc590d2618297b99e7f
SHA512

325124b64cdb439065f161d8f342e0cd833a2f58fb021c3763cf82198e6598b178ccbb45f9d5f31f74bc303b9a0da17dbece68c6edacf32b53cce92c56ae371c
SSDEEP

3072:MtR1csuBZgfAZoHd3O5pwHtZ48U11rF3:MtDVXfWJwr4t1r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 43 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000d556ac66100041646d696e00380008000400efbed5564f5ad556ac662a00000033000000000003000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000d5564f5a1100557365727300600008000400efbeee3a851ad5564f5a2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000d5564f5a122041707044617461003c0008000400efbed5564f5ad5564f5a2a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5a00310000000000de567d5f102051524e57425a7e310000420008000400efbede567d5fde567d5f2a000000e722010000000b000000000000000000000000000000510052004e00570062005a004f00570045005200000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000d5564a5c10204c6f63616c00380008000400efbed5564f5ad5564a5c2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000de567d5f102054656d700000360008000400efbed5564f5ade567d5f2a00000001020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = 5a00310000000000de567d5f102051524e57425a7e310000420008000400efbede567d5fde567d5f2a000000ea22010000000a000000000000000000000000000000510052004e00570062005a004f00570045005200000018000000	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

explorer.exe

pid process

860 explorer.exe

pid	process
860	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1128	1200	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 1676	1128	rundll32.exe	explorer.exe
PID 1128 wrote to memory of 1676	1128	rundll32.exe	explorer.exe
PID 1128 wrote to memory of 1676	1128	rundll32.exe	explorer.exe
PID 1128 wrote to memory of 1676	1128	rundll32.exe	explorer.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1a9d76f3baa944f8570dc96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b1a9d76f3baa944f8570dc96.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER
3⤵
PID:1676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER\QRNWbZOWER1.lnk

Filesize
1KB

MD5
f44d5ee13a23be076949ac41f7681d75

SHA1
cba36518a9ee93eaeb9e55128ee3249ee110beec

SHA256
839c9de0fdf2b512787e33410976adb49d03d40097df8e9dd665aa8e5c9acf2b

SHA512
e946e003e72617322648f4c31dc9499232538fef2c5eed2bff201a581025d0ba8961933f1f012b2b314a91c39d98dd05aad71613c6ffbebdfb010410cd356842

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER\QRNWbZOWER2.lnk

Filesize
1KB

MD5
f44d5ee13a23be076949ac41f7681d75

SHA1
cba36518a9ee93eaeb9e55128ee3249ee110beec

SHA256
839c9de0fdf2b512787e33410976adb49d03d40097df8e9dd665aa8e5c9acf2b

SHA512
e946e003e72617322648f4c31dc9499232538fef2c5eed2bff201a581025d0ba8961933f1f012b2b314a91c39d98dd05aad71613c6ffbebdfb010410cd356842

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER\QRNWbZOWER3.lnk

Filesize
1KB

MD5
f44d5ee13a23be076949ac41f7681d75

SHA1
cba36518a9ee93eaeb9e55128ee3249ee110beec

SHA256
839c9de0fdf2b512787e33410976adb49d03d40097df8e9dd665aa8e5c9acf2b

SHA512
e946e003e72617322648f4c31dc9499232538fef2c5eed2bff201a581025d0ba8961933f1f012b2b314a91c39d98dd05aad71613c6ffbebdfb010410cd356842

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER\QRNWbZOWER4.lnk

Filesize
1KB

MD5
f44d5ee13a23be076949ac41f7681d75

SHA1
cba36518a9ee93eaeb9e55128ee3249ee110beec

SHA256
839c9de0fdf2b512787e33410976adb49d03d40097df8e9dd665aa8e5c9acf2b

SHA512
e946e003e72617322648f4c31dc9499232538fef2c5eed2bff201a581025d0ba8961933f1f012b2b314a91c39d98dd05aad71613c6ffbebdfb010410cd356842

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER\QRNWbZOWER5.lnk

Filesize
1KB

MD5
f44d5ee13a23be076949ac41f7681d75

SHA1
cba36518a9ee93eaeb9e55128ee3249ee110beec

SHA256
839c9de0fdf2b512787e33410976adb49d03d40097df8e9dd665aa8e5c9acf2b

SHA512
e946e003e72617322648f4c31dc9499232538fef2c5eed2bff201a581025d0ba8961933f1f012b2b314a91c39d98dd05aad71613c6ffbebdfb010410cd356842

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRNWbZOWER\QRNWbZOWER\QRNWbZOWER5.lnk

Filesize
1KB

MD5
f44d5ee13a23be076949ac41f7681d75

SHA1
cba36518a9ee93eaeb9e55128ee3249ee110beec

SHA256
839c9de0fdf2b512787e33410976adb49d03d40097df8e9dd665aa8e5c9acf2b

SHA512
e946e003e72617322648f4c31dc9499232538fef2c5eed2bff201a581025d0ba8961933f1f012b2b314a91c39d98dd05aad71613c6ffbebdfb010410cd356842

Download Submit
memory/860-59-0x0000000003740000-0x0000000003750000-memory.dmp

Filesize
64KB

Download
memory/860-65-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/860-66-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads