bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324

General

Target

bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe
Size

756KB
MD5

d7be2192fc7cb22db8a2acdbf4bbdafe
SHA1

89d97962f8d193fcb91402574046304fbfe2e89f
SHA256

bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324
SHA512

e0da02125907eade276c6489af7bccfae29ab6d07a7936dc59d3fd041d723e2840a57197fea5ba11425c37f6fe0f36570610e13ce2d7ace7823955416de6d799
SSDEEP

12288:FNpszYhvXWSVJdMae3mUJUTOMsa+0zNOabK3ghMZtc6NS+0Ulk287/k/MjuLle:7hvJVJdMa1+wOmK3gglSjUlkVzuLs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2256	3012	bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe	23
PID 3012 wrote to memory of 2256	3012	bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe	23
PID 3012 wrote to memory of 2256	3012	bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe	23
PID 3012 wrote to memory of 2256	3012	bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe	23
PID 2256 wrote to memory of 2860	2256	cmd.exe	20
PID 2256 wrote to memory of 2860	2256	cmd.exe	20
PID 2256 wrote to memory of 2860	2256	cmd.exe	20
PID 2256 wrote to memory of 2860	2256	cmd.exe	20
PID 2256 wrote to memory of 2872	2256	cmd.exe	21
PID 2256 wrote to memory of 2872	2256	cmd.exe	21
PID 2256 wrote to memory of 2872	2256	cmd.exe	21
PID 2256 wrote to memory of 2872	2256	cmd.exe	21

C:\Users\Admin\AppData\Local\Temp\bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe
"C:\Users\Admin\AppData\Local\Temp\bd85a708785e2644c6e719041bfd53c3ae3f9820ea13f26e0ec08813769a1324.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.com.exe.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256

C:\Windows\SysWOW64\certutil.exe
certutil -f -decode t "C:\Users\Admin\AppData\Local\Temp\file.com.exe"
1⤵
PID:2860

C:\Windows\SysWOW64\explorer.exe
explorer "C:\Users\Admin\AppData\Local\Temp\file.com.exe"
1⤵
PID:2872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.com.exe.bat

Filesize
44KB

MD5
2eeeb2ff1b16cf5d7cdbf3109ccf59cf

SHA1
bbf485a60dff4eaf24a78e4250212ff20f167f56

SHA256
bd3fdee93cd418e2467d6e38db099898b1d553c2986fcc1905a7362178d65dff

SHA512
17147a51371575b737232ea80744376a59cac5a9249457d85395c6249aff6adf3d9f44ced1ab5411c29b678be932ab75b0d653e2bb18348f0e23e9b5139c80c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\file.com.exe.bat

Filesize
148KB

MD5
321d5cbdcc30fe80e6baa5abc4e63efd

SHA1
d0483215384ceb88329b0e4dde86b415b43ee601

SHA256
72de6710bb046b3f89e4ed0fd7271e0e6d02c0143fe2fe223d81e352b6387b80

SHA512
fd82bc893ac8e22d90688a275712ea55367aa6044863fddbbb42f0c26145050327023ddf57e15057ed25f86f2c218f8accf0e126ea19c3b4a794103c824d0362

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\t

Filesize
97KB

MD5
ea548468f42b2aaaee5af5ea16f57409

SHA1
089942b8063c97f88d3b2d74f07bf29dc2b630c1

SHA256
909aefa12debbb09028def5afaba308766e35d125db00a4a1668496260ef4113

SHA512
2c8954c8486db6ed30669a87ae1ce6212f71c49f9a42739149bb611704756887460090b7b0bd8cca868c4085df579f44be9b7cccaecb52be55b7849997863a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\t

Filesize
80KB

MD5
73d4b598d0cd170fe0e3cde33b40235f

SHA1
64582c61887100528c91336de07c65544b2a8389

SHA256
81f811ddb39934e022f313ce5827b5f7a1ac6e67b201687d42fcad9c80a0fff6

SHA512
686a6f22c3c814ed186149abb821c01e121b9e44530c28f76a4eb9d1cffc9c96c3761bddf1c63393af71d23afccd4dc2976ad663edf5a67171bce512d3f501cc

Download Submit
memory/2168-112-0x0000000003AA0000-0x0000000003AB0000-memory.dmp

Filesize
64KB

Download
memory/2168-111-0x0000000003A90000-0x0000000003A91000-memory.dmp

Filesize
4KB

Download
memory/2168-113-0x0000000003A90000-0x0000000003A91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing