794f69a8da9cf706107a43b8806673c8528c02b161c7b4eb242619966b61758d

General

Target

0ed17218922983563f641205bf3633e4.exe
Size

136KB
MD5

0ed17218922983563f641205bf3633e4
SHA1

3390496a47723f0580cf30e4452ed72850716cd6
SHA256

794f69a8da9cf706107a43b8806673c8528c02b161c7b4eb242619966b61758d
SHA512

aaa168d71bfbd3ae3091b55e35a7d18c10733bdcdb0fd7d6ef291d413a98287777cb78b3f24d55c2a41e6fbcaae5fa9889641c47787eb79f98c1167f4bfc25e5
SSDEEP

3072:WHbm4jjtFbC4O13RKrEgOEi3w0wZ5XQ3DPm3gX9MaBdCeXrFVzAD6TblE/:W6uOs0wZ5XQ3Lm3gX9MaBdCeXBVEu

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0ed17218922983563f641205bf3633e4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0ed17218922983563f641205bf3633e4.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1052623846"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079472"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079472"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1053404846"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{734E934E-A823-11EE-B6AD-DE9D3A49EF0E} = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2376	0ed17218922983563f641205bf3633e4.exe
3852	0ed17218922983563f641205bf3633e4.exe
1724	iexplore.exe
1724	iexplore.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3852	2376	0ed17218922983563f641205bf3633e4.exe	95
PID 2376 wrote to memory of 3852	2376	0ed17218922983563f641205bf3633e4.exe	95
PID 2376 wrote to memory of 3852	2376	0ed17218922983563f641205bf3633e4.exe	95
PID 1724 wrote to memory of 3968	1724	iexplore.exe	105
PID 1724 wrote to memory of 3968	1724	iexplore.exe	105
PID 1724 wrote to memory of 3968	1724	iexplore.exe	105

C:\Users\Admin\AppData\Local\Temp\0ed17218922983563f641205bf3633e4.exe
"C:\Users\Admin\AppData\Local\Temp\0ed17218922983563f641205bf3633e4.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\0ed17218922983563f641205bf3633e4.exe
  C:\Users\Admin\AppData\Local\Temp\0ed17218922983563f641205bf3633e4.exe cjbotdesktop2561
  2⤵
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3852

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2560

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:17410 /prefetch:2
  2⤵
  PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads