63fa740d0fc617e3b988e2fe76d04e8bf01389b1c201c87507e0bcbb6b950627

Analysis

max time kernel
169s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ad09158d17eb0082cd38d8cb85784d.exe
Size

26KB
MD5

09ad09158d17eb0082cd38d8cb85784d
SHA1

637d7ea78a8649e188d80be7591cca793ac923e5
SHA256

63fa740d0fc617e3b988e2fe76d04e8bf01389b1c201c87507e0bcbb6b950627
SHA512

036e09b064fec8a3f6d54748890271de7c0f6de806d38ee5c939391bb328f11881a800de6feeb661a7df60f2129c0370e2f264de23b81b25299610491eb1d44e
SSDEEP

384:ZuMLHKwktmNQubh2Va0f59olzPtuYzZuZNMGLBqkBSdl:ZJbKftmNQubhjQ+zPtuYYNLjB4

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Apwheel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\09ad09158d17eb0082cd38d8cb85784d.exe"	09ad09158d17eb0082cd38d8cb85784d.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International	09ad09158d17eb0082cd38d8cb85784d.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "232008622"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079312"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4e92002c4a416439bca1d31c27b840500000000020000000000106600000001000020000000847adf63384d9ad05ecd3e770377a1c637f4398b3cffefbe1f9d270967b5a889000000000e8000000002000020000000d3fda69d579c392e503342e1fb768f1b9dd6ad811060995575eeeab009e8237220000000a1c8adfdf54d901b2b472b6d1235f0316186adc920dc0f9bd8270d2f3f22d8f940000000e22bf8ec61efacd6efac032fce11c7ae6bbdb07dd091753af344d3e28f666050943b98c3d215eb4732ee7964eea98e07a8dd4fc965e68ada14ee5f3caa916219	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079312"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3839687F-A783-11EE-BB4F-4EA1437444E8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a7d214903bda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main	09ad09158d17eb0082cd38d8cb85784d.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "232008622"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4e92002c4a416439bca1d31c27b84050000000002000000000010660000000100002000000074e6f490740bc341107963afb759e2669a38043430f0430244fd5954e054e9ee000000000e8000000002000020000000fe3630637401c1121d3b4698687f91a2bf6faff49cc0cf4a47589b9cb38443932000000027281453dc1e3b32aaa7e7fab70c9124a1504eed421f376d577d87a338f5df2c40000000f885bc08f95e266f66e6884aaee1ae7ac92560d8d86311814ad88c7552dff7fc4f15833f0a4233f5ac4723257b2b1a6521a048981169bb704beaede1302b7197	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a99617903bda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\guid = "37071023-8dbb-4dbe-9fdc-34db0088c6f2"	09ad09158d17eb0082cd38d8cb85784d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1124	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1124	iexplore.exe
1124	iexplore.exe
4492	IEXPLORE.EXE
4492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4492	1124	iexplore.exe	93
PID 1124 wrote to memory of 4492	1124	iexplore.exe	93
PID 1124 wrote to memory of 4492	1124	iexplore.exe	93

C:\Users\Admin\AppData\Local\Temp\09ad09158d17eb0082cd38d8cb85784d.exe
"C:\Users\Admin\AppData\Local\Temp\09ad09158d17eb0082cd38d8cb85784d.exe"
1⤵
- Adds Run key to start application
- Modifies Control Panel
- Modifies Internet Explorer settings
PID:2092

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\config.txt

Filesize
578B

MD5
3dcbdd92f73bf59891f8bb9ed4ea6b49

SHA1
040d4db54624966ae5a05ec70a3a4abd92b9f46a

SHA256
e77a8c382fea1cf1989cf3e9ee27fe54499d08994109f9dd6ac4d3808da4019f

SHA512
8d6a4f35e4814ae23a763022dad59f8702241dbd50d81dedf79ea7ceb501f481e5b10c8f64bc174dc39bbebe46fedb245f12a51aabbef3de43e06bc685ecc182

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads