b48e1d085c65c45cef76cf56d8e14e5b21018fe99247f6dfd163f80416f706af

General

Target

29801c942c575ab793c4dddd5f32fb5e.exe
Size

43KB
MD5

29801c942c575ab793c4dddd5f32fb5e
SHA1

c5863865c3815b3955e7e5f3d72f9facd87e56c7
SHA256

b48e1d085c65c45cef76cf56d8e14e5b21018fe99247f6dfd163f80416f706af
SHA512

4af3cfe7773ea0d0db130c2912394f1764fdcfe3b4f3f1a3dabcae6fbd51a81e905daca978e0bc7e0374da16247e9cd69a408eb7dbe485d6c5b93f1a64aabb1d
SSDEEP

768:sCyIqlymQsTTNmsh1jScnr8oBC5aqdSKQTlKo3OJ6hivfeX8BXjn:8IqlymQa4sPjQoI4qYKQhKwGTOgn

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2860	29801c942c575ab793c4dddd5f32fb5e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\explorE.exe = "C:\\Program Files\\explorE.exe"	29801c942c575ab793c4dddd5f32fb5e.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\systemlj.dll	29801c942c575ab793c4dddd5f32fb5e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\explorE.exe	29801c942c575ab793c4dddd5f32fb5e.exe
File opened for modification	C:\Program Files\explorE.exe	29801c942c575ab793c4dddd5f32fb5e.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BBF2101-ABE0-11EE-A7D5-D2C28B9FE739} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2860	29801c942c575ab793c4dddd5f32fb5e.exe
1084	IEXPLORE.EXE
1084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1084	2860	29801c942c575ab793c4dddd5f32fb5e.exe	16
PID 2860 wrote to memory of 1084	2860	29801c942c575ab793c4dddd5f32fb5e.exe	16
PID 2860 wrote to memory of 1084	2860	29801c942c575ab793c4dddd5f32fb5e.exe	16
PID 2860 wrote to memory of 1084	2860	29801c942c575ab793c4dddd5f32fb5e.exe	16
PID 1084 wrote to memory of 2620	1084	IEXPLORE.EXE	17
PID 1084 wrote to memory of 2620	1084	IEXPLORE.EXE	17
PID 1084 wrote to memory of 2620	1084	IEXPLORE.EXE	17
PID 1084 wrote to memory of 2620	1084	IEXPLORE.EXE	17

C:\Users\Admin\AppData\Local\Temp\29801c942c575ab793c4dddd5f32fb5e.exe
"C:\Users\Admin\AppData\Local\Temp\29801c942c575ab793c4dddd5f32fb5e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
    3⤵
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\systemlj.dll

Filesize
24KB

MD5
f765cf58700f3cd02cd47701bc45ef12

SHA1
386ad3297972121f01c3db9bb250b1d2384f5b85

SHA256
278a47fb5248d5da7ecb7f734205fc16605f789c4adc3ddcc6c7a3a6a22d1850

SHA512
42266679e1014f201fae6e11101de5ccd527968d1b6c2fb9ed1ef165b19c0e0b2cee6715d0823f38252f01ec51dde6ae946cc152004d5e59a88c1849e8993f2a

Download Submit
memory/2860-2-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/2860-8-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/2860-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads