139beb0e5b4cc80f0825fa410ed6288db8dd21b40c9f4b3bde8857e73443c309

General

Target

284f70d2dbf419c70a6f2d345116bdfe.exe
Size

207KB
MD5

284f70d2dbf419c70a6f2d345116bdfe
SHA1

aaa10108e3b3975bad75ae973d11fa26d43bcbe1
SHA256

139beb0e5b4cc80f0825fa410ed6288db8dd21b40c9f4b3bde8857e73443c309
SHA512

9b48123f356459408d9d10dc1886cc5200faabe0a68c062cb110bd0704b8151575dfd15e062686270a007a7a411c0be83fad7d5d393db583ac2f5a7e56702c1d
SSDEEP

6144:Xz+92mhAMJ/cPl3iwjaozlx/LVXHSPF0Mfs:XK2mhAMJ/cPl1T7VXJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
672	wsmallstub.exe

Loads dropped DLL 4 IoCs

pid	Process
2556	284f70d2dbf419c70a6f2d345116bdfe.exe
2556	284f70d2dbf419c70a6f2d345116bdfe.exe
2556	284f70d2dbf419c70a6f2d345116bdfe.exe
2556	284f70d2dbf419c70a6f2d345116bdfe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FA124A1-A5AB-11EE-A03E-DED0D00124D2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
672	wsmallstub.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 2556 wrote to memory of 672	2556	284f70d2dbf419c70a6f2d345116bdfe.exe	27
PID 672 wrote to memory of 2912	672	wsmallstub.exe	31
PID 672 wrote to memory of 2912	672	wsmallstub.exe	31
PID 672 wrote to memory of 2912	672	wsmallstub.exe	31
PID 672 wrote to memory of 2912	672	wsmallstub.exe	31
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32
PID 2912 wrote to memory of 2080	2912	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\284f70d2dbf419c70a6f2d345116bdfe.exe
"C:\Users\Admin\AppData\Local\Temp\284f70d2dbf419c70a6f2d345116bdfe.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe" "C:\Users\Admin\AppData\Local\Temp\284f70d2dbf419c70a6f2d345116bdfe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://ct2416693.ourtoolbar.com/cre/?isorganic=true&requesterid=dmstub
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\icon.ico

Filesize
1KB

MD5
f31ab27282cf444ef1f263320be6b705

SHA1
bde4d76ffc88d14e1128b4928ddd4639a7744b84

SHA256
1a3ec42f393635307ae2e369ef50a8eb0fbbe02cd2f82c4c6d3486d294ddcceb

SHA512
f6b803b087444de0cc6fa832c4be491c738c0d643895d844a861357e2b29257fe7ba91f2e4e61ee715a5b533b0449c14428f79ec651f3cfa3823eaaaa99ca367

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub_settings.xml

Filesize
3KB

MD5
b64d43be07c431b8b2477f7303b2a8e2

SHA1
e42f245ac4078f8b84e85514574244846c483157

SHA256
4fd26dc9c1e6f863b7365d24559f55c39e1c07741e3cbba9f45175198e969256

SHA512
2fcc9516db288e2cd7876057db6e7172b0b9775f8b094ab8547aac0e3075bd4c0f34ec575692d68afb77e853c86fa85e973a727dc0629dd869e14929f5012b80

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe

Filesize
238KB

MD5
bebe87e70601cbc95c4a6bad2a2e986d

SHA1
f9620534bf97ff4ecaadd3afc3808d3abecdac65

SHA256
f1fe856f82e455e19d17f09e0b8529993aa540d4231c07065f0c28ecf0f25dd4

SHA512
dae6eabf8314529be871d56c4c573cc114309d77a5223f48227d0c13964cd6606efbe413e8b1fdd7624be89fc31be8caa7d299ed2e659f9c4e1982f21e1cffd2

Download Submit

Analysis

Sharing