40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978

General

Target

40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
Size

14.5MB
MD5

f4de58393b1261566a4d129278f76c91
SHA1

f86d7cc285478f0f046ab22dba6244981a0f28c1
SHA256

40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978
SHA512

6d22847b999bdbb3b1d5c385b3f8ac751221fb3ead35ff77dc649c2e7cacfa711bb43579a73e108445cda4bb20c7b8f80792982a806bf9827257b7c9b0c3245f
SSDEEP

393216:gA/0QWxLcSL7oeGEblg/EYIDgwWknoO+bUFevt:gjQWNcSL7QEb6JIswWknoO+b5t

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Internet Explorer\International\CpMRU	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2088	1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe	90
PID 1892 wrote to memory of 2088	1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe	90
PID 1892 wrote to memory of 2088	1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe	90
PID 1892 wrote to memory of 3716	1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe	91
PID 1892 wrote to memory of 3716	1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe	91
PID 1892 wrote to memory of 3716	1892	40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe	91

C:\Users\Admin\AppData\Local\Temp\40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe
"C:\Users\Admin\AppData\Local\Temp\40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*03e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exe"
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
  2⤵
  PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40503e287ab71927df9389405f8f75d35299736ee1e0cd813605d03d3d250978.exepack.tmp

Filesize
2KB

MD5
2da3deba5f134c4fffcd557789ff42fe

SHA1
eb96ba3ea478e84251b18f0ad77181938075edde

SHA256
62056286fbe574327b8fe2b0b899e73b9c155e7af5899ed41acf5550843625f8

SHA512
f66988b6be82ada5f27652bed6a807ceea5ba9b1cc57f8e821cd2f912db3ecb99c461d74ca943b29ef0e1b79b0d3f559c5c45047de6d9a399517bff43631574b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6530cbab1b99eec28e665847995efe63.ini

Filesize
2KB

MD5
e7961185048d7fea2d128bcc1fd34ec6

SHA1
5e578a27cb14a3ada6f9e66418b0484fb7d34bfd

SHA256
62ad1629c7edd9c08c89ca837832838ed9553e2b1c78146f07346556247cb2c3

SHA512
f848a48cd014bc6dddcdecededf25e2d750b1d33ee10d10b3d738cfb4a9bd3fa5466570f0b7f9c25b00b08423960508f811c53efd73e622c72a338f8a52eb83b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6530cbab1b99eec28e665847995efe63A.ini

Filesize
1KB

MD5
c0d7496332120d41a7e02d3411d9c5dc

SHA1
e6ba7a30c5f3f86b57f48e61cfec77861492f223

SHA256
538e316246ac4dbba92b1e7af7d195c67e5cdb096ead70f5a795450bfafdab7c

SHA512
31f720082fa8c66e04f3ef833acd8073c75ae98ba6ce6eae81b22c422c2fff673a39b9963cc65d9e8ddb144d261c0fcb87ae826979cc28044abda6be9658ef08

Download Submit
memory/1892-4-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/1892-6-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-5-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-8-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/1892-0-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-2-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/1892-339-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-340-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-350-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/1892-351-0x0000000000400000-0x00000000025C9000-memory.dmp

Filesize
33.8MB

Download
memory/1892-352-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing