6ad06030aa4d682d2ae59c7cc3670eee977aaeb0b7a482d0e2f1dd90909ba8cc

General

Target

1a8e6c1e73e5383e91d01bf367c50446.exe
Size

9.7MB
MD5

1a8e6c1e73e5383e91d01bf367c50446
SHA1

f19ab9908544af10788c6aa60715a823aef7e328
SHA256

6ad06030aa4d682d2ae59c7cc3670eee977aaeb0b7a482d0e2f1dd90909ba8cc
SHA512

40af78734da0295af2ab3f17f6fcc12ba59eae2b98b72033600c2eff35255f4f26382de6758adb41eab509a340c30c6b062e12f49193213344db9013baf39a3e
SSDEEP

98304:/POCQQdrQS8jQIj1qYT5UnbVloeFVRFHFq0N8WaumOQp0BAUZLtYXgwtuD:/PDxQS2EPLPFHFZNKumOQp0VREg4G

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2656	2888	1a8e6c1e73e5383e91d01bf367c50446.exe	30
PID 2888 wrote to memory of 2656	2888	1a8e6c1e73e5383e91d01bf367c50446.exe	30
PID 2888 wrote to memory of 2656	2888	1a8e6c1e73e5383e91d01bf367c50446.exe	30
PID 2888 wrote to memory of 2656	2888	1a8e6c1e73e5383e91d01bf367c50446.exe	30

C:\Users\Admin\AppData\Local\Temp\1a8e6c1e73e5383e91d01bf367c50446.exe
"C:\Users\Admin\AppData\Local\Temp\1a8e6c1e73e5383e91d01bf367c50446.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://crashmine.xyz/mcchecker/update/checker.exe
  2⤵
  - Modifies Internet Explorer settings
  PID:2656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-2-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000077550000-0x0000000077551000-memory.dmp

Filesize
4KB

Download
memory/2888-0-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/2888-7-0x0000000010000000-0x00000000106A5000-memory.dmp

Filesize
6.6MB

Download
memory/2888-6-0x0000000010000000-0x00000000106A5000-memory.dmp

Filesize
6.6MB

Download
memory/2888-22-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/2888-21-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/2888-20-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/2888-17-0x00000000006A0000-0x00000000006CF000-memory.dmp

Filesize
188KB

Download
memory/2888-16-0x00000000006A0000-0x00000000006CF000-memory.dmp

Filesize
188KB

Download
memory/2888-14-0x00000000006A0000-0x00000000006CF000-memory.dmp

Filesize
188KB

Download
memory/2888-26-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/2888-25-0x00000000006A0000-0x00000000006CF000-memory.dmp

Filesize
188KB

Download
memory/2888-24-0x0000000010000000-0x00000000106A5000-memory.dmp

Filesize
6.6MB

Download
memory/2888-23-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/2888-27-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2888-28-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/2888-31-0x00000000006D0000-0x00000000006E4000-memory.dmp

Filesize
80KB

Download
memory/2888-39-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/2888-117-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/2888-577-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing