d15b63670bb45af2fcc14c66687e0114bb4f5ae8e1c0923e28fb5eaf82799e0a

General

Target

3ea69f0171d750b82dc667db1b6cf01c.exe
Size

143KB
MD5

3ea69f0171d750b82dc667db1b6cf01c
SHA1

fd5f9692ebafbeae2ba6aab47f2a041c1616c472
SHA256

d15b63670bb45af2fcc14c66687e0114bb4f5ae8e1c0923e28fb5eaf82799e0a
SHA512

24315e99d69b9226a03bf7b1c11da923a7201490812545abaaeac1affe0a2ebf3b113d3e7f3643582c56cdf9b9dad99fe133535f7a8f6bb2fbffcd7520dbc6db
SSDEEP

3072:wamXeCtkCubJCXxoNTBf4QFFPCXip07v917Yq:waKkbAaNTBQQjCXbrz5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{050E29B1-AA3C-11EE-86D4-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1896	2940	3ea69f0171d750b82dc667db1b6cf01c.exe	27
PID 2940 wrote to memory of 1896	2940	3ea69f0171d750b82dc667db1b6cf01c.exe	27
PID 2940 wrote to memory of 1896	2940	3ea69f0171d750b82dc667db1b6cf01c.exe	27
PID 2940 wrote to memory of 1896	2940	3ea69f0171d750b82dc667db1b6cf01c.exe	27
PID 2716 wrote to memory of 2928	2716	iexplore.exe	30
PID 2716 wrote to memory of 2928	2716	iexplore.exe	30
PID 2716 wrote to memory of 2928	2716	iexplore.exe	30
PID 2716 wrote to memory of 2928	2716	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\3ea69f0171d750b82dc667db1b6cf01c.exe
"C:\Users\Admin\AppData\Local\Temp\3ea69f0171d750b82dc667db1b6cf01c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\A4F6.tmp\A4F7.tmp\A4F8.vbs //Nologo
  2⤵
  PID:1896

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50c2512b0a9d6b5070836fdce93adc4

SHA1
f8ba38ddd6320f50dd0a78dbd2ef6c1c99b1d62d

SHA256
2172378b4fc953ac88b776fabf60b38e53f2d838c8a937743b75713dee4f666e

SHA512
edc8d4a5fd1968458808105d395c53a4fabfe30a08c1b2f09b5416bdeb1f2d15d51749ccff7c87560c70aa7a1ce0c7d2dc1359f8780a891a07c160ef79b13c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63ff39972280853147a5ff8c300236cd

SHA1
768e90f3b4e8e9ec518b17616e2ba0d779720d16

SHA256
6a577b60c7986cfa086c8fbfca927a433e2e4b9a77745b6f1d5f28356e8476c9

SHA512
47dce06facb359a04dac0c50bad4d7c73514e9b033e824e93f2cbfba0d9cebebe1fa29857b86bd5b9ca2aeadf8ba951bc6541c6d52a3795b3ce83e40648b79e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp\A4F7.tmp\A4F8.vbs

Filesize
2KB

MD5
1d5ac9f3c98eb3788047a52cc38fd59d

SHA1
ae195bc84b9f9fa4809269894529837aca3b9cd3

SHA256
1178ff587cc4c05718da3c64c21875746919f9bc5c188a42a1e88c2165ed9ceb

SHA512
d6bba0e5f0435fea6b8a354acf985a892e6cf913487095cff32d5ff48c4c84dc0deb02f53ffc6f0e8afccdf2b72821c66361896ef6e7c44635dfc4f4c2dfd841

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBBB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCA8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1896-2-0x0000000000150000-0x0000000000160000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing