7c6ff03fb7195480f0cc40cb6f33e08127b2a6777ff4648fdef264df79b3c194

General

Target

38718245184746f131ef7b4fe08d6faf.exe
Size

160KB
MD5

38718245184746f131ef7b4fe08d6faf
SHA1

55d7f8be2c2e1a9fe01e1e448137f1aaee76dad3
SHA256

7c6ff03fb7195480f0cc40cb6f33e08127b2a6777ff4648fdef264df79b3c194
SHA512

9e74efeb53b0cdd010f6f0f81d3b658cafa026722ea9f2007ff8fed64f9aa97ce4a5a779695394729683896950e6ebc5463d0d8c88f05d277f2a85a612774308
SSDEEP

768:tesigqKesigqH9wp42PVqtTfVvHREDBhRlC3IsOaQiBFfFtr8xoT6j:obnc42PVoZRUBH8ROaQiBlzn

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	38718245184746f131ef7b4fe08d6faf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\zyn_df = "C:\\Windows\\system\\zyndle080808.exe"	38718245184746f131ef7b4fe08d6faf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system\zyndld32080808.dll	38718245184746f131ef7b4fe08d6faf.exe
File created	C:\Windows\system\zyndle080808.exe	38718245184746f131ef7b4fe08d6faf.exe
File opened for modification	C:\Windows\system\zyndle080808.exe	38718245184746f131ef7b4fe08d6faf.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	38718245184746f131ef7b4fe08d6faf.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{13EFCB6F-ABAA-11EE-AA35-E2EC48AD62A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3784	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe
2672	38718245184746f131ef7b4fe08d6faf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	38718245184746f131ef7b4fe08d6faf.exe
Token: SeDebugPrivilege	2672	38718245184746f131ef7b4fe08d6faf.exe
Token: SeDebugPrivilege	2672	38718245184746f131ef7b4fe08d6faf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3504	iexplore.exe
3504	iexplore.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 3504	2672	38718245184746f131ef7b4fe08d6faf.exe	93
PID 2672 wrote to memory of 3504	2672	38718245184746f131ef7b4fe08d6faf.exe	93
PID 3504 wrote to memory of 3316	3504	iexplore.exe	94
PID 3504 wrote to memory of 3316	3504	iexplore.exe	94
PID 3504 wrote to memory of 3316	3504	iexplore.exe	94

C:\Users\Admin\AppData\Local\Temp\38718245184746f131ef7b4fe08d6faf.exe
"C:\Users\Admin\AppData\Local\Temp\38718245184746f131ef7b4fe08d6faf.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\program files\internet explorer\iexplore.exe
  "C:\program files\internet explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3504 CREDAT:17410 /prefetch:2
    3⤵
    PID:3316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\dfDelmlljy.bat" "
  2⤵
  PID:1132

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verDFB2.tmp

Filesize
10KB

MD5
943617000f28725e307376987c605d63

SHA1
30885a81161f9822db73435ad3126691e1a05967

SHA256
929016d08018f9e6d2e54ec82193f0c88bb4093dfe1fa8c53806359e401a286b

SHA512
655a99e817795f44aeb2cce45b980a0f98f195821846c64f36bbc66f0c5cf21f65672087eed776ed3fc15315e7726dd47273834b12cfe81831903a4d5859f7c0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads