c2a2d3bbf084ebdc4974f6e9f9ed861a0165fd842cc85b351e5928277b7a275e

General

Target

039a92d1a3f58a5f93608825258fd98e.exe
Size

3KB
MD5

039a92d1a3f58a5f93608825258fd98e
SHA1

bd7ea8e979d3c52a15036886949a3aeaf0286208
SHA256

c2a2d3bbf084ebdc4974f6e9f9ed861a0165fd842cc85b351e5928277b7a275e
SHA512

e4f25a5f7deee0a5782761f37109325646a67ec31021f9f6aec0a4e536a604ec1b17c76122c69bfad22c4e81daa0e39c31518c41bd7f204862147b5adc4e6263

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	039a92d1a3f58a5f93608825258fd98e.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	039a92d1a3f58a5f93608825258fd98e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	039a92d1a3f58a5f93608825258fd98e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71\WpadDecisionReason = "1"	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadDecisionReason = "1"	039a92d1a3f58a5f93608825258fd98e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadNetworkName = "Network 3"	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71	039a92d1a3f58a5f93608825258fd98e.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71\WpadDecisionTime = d04dec03b33ada01	039a92d1a3f58a5f93608825258fd98e.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	039a92d1a3f58a5f93608825258fd98e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\a6-31-c2-07-c2-71	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71\WpadDecision = "0"	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	039a92d1a3f58a5f93608825258fd98e.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadDecisionTime = d04dec03b33ada01	039a92d1a3f58a5f93608825258fd98e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	039a92d1a3f58a5f93608825258fd98e.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadDecision = "0"	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	039a92d1a3f58a5f93608825258fd98e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	039a92d1a3f58a5f93608825258fd98e.exe

C:\Users\Admin\AppData\Local\Temp\039a92d1a3f58a5f93608825258fd98e.exe
"C:\Users\Admin\AppData\Local\Temp\039a92d1a3f58a5f93608825258fd98e.exe"
1⤵
PID:1960

C:\Users\Admin\AppData\Local\Temp\039a92d1a3f58a5f93608825258fd98e.exe
C:\Users\Admin\AppData\Local\Temp\039a92d1a3f58a5f93608825258fd98e.exe -A
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1960-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2936-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads