6d30183eff9c3597b7a9dedd28becb62a07a6b26681a0bfd9de3785754d0dc59

General

Target
4cf4c7e74d99b1627707cb1dfc706a75.exe
Size 4.9MB
Sample240109-bmx3jsaafq
SHA256 6d30183eff9c3597b7a9dedd28becb62a07a6b26681a0bfd9de3785754d0dc59
MD5 4cf4c7e74d99b1627707cb1dfc706a75
SHA1 7e95e592c3e01fef3c1495c1426ec6a509d0b6a5
SHA512 7cfc62ce18a56c3b6a67c100d720dbf48f84b8d1357a0280f0743956b6975f9f8ea93110fd34c0c5d94687ebb21cb293a1b6eb018dc1f83827f533981d8c5a1c
SSDEEP 98304:0534CwGglnOriL4vJ0u7zunUXHSwYO3T/bmH6wlgbFy4mVSQBUcJOKy/ny:0NwlOriaJlGUXHHYOjqHvlgbFj4UWyfy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe
2696	4cf4c7e74d99b1627707cb1dfc706a75.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\SearchScopes	4cf4c7e74d99b1627707cb1dfc706a75.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{24588FA4-10F1-41D7-B19D-6E22361E47FA}"	4cf4c7e74d99b1627707cb1dfc706a75.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}	4cf4c7e74d99b1627707cb1dfc706a75.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\Codepage = "65001"	4cf4c7e74d99b1627707cb1dfc706a75.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\DisplayName = "°Ù¶È"	4cf4c7e74d99b1627707cb1dfc706a75.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\URL = "http://www.baidu.com/s?wd={searchTerms}&tn=site888_1_pg&cl=3&ie=utf-8"	4cf4c7e74d99b1627707cb1dfc706a75.exe

C:\Users\Admin\AppData\Local\Temp\4cf4c7e74d99b1627707cb1dfc706a75.exe
"C:\Users\Admin\AppData\Local\Temp\4cf4c7e74d99b1627707cb1dfc706a75.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrandingURL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq48E1.tmp\BrandingURL.dll
Size 3KB
SHA256 05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a
MD5 9c3488b5e9655d1837c3963ecec33f70
SHA1 f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3
SHA512 6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq48E1.tmp\InstallOptions.dll
Size 14KB
SHA256 747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58
MD5 b18dfaded8f6d2380fdfd8f6b6969211
SHA1 969fa0e906240ab1123254feeb833c275626cf76
SHA512 25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c
SSDEEP 192:66JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTLK72dwF7dBdcQOz:66JaVh4I5rpPbTL+BdhO
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq48E1.tmp\System.dll
Size 10KB
SHA256 f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779
MD5 810f3a0aefe36a9f63e29e604bea91a9
SHA1 2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80
SHA512 836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb
SSDEEP 192:CO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1argMO:XKAFERdlxhGRYUzqZar
MD5 SHA1 SHA512 SSDEEP

Submit Download

ToolTips.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq48E1.tmp\ToolTips.dll
Size 4KB
SHA256 28aeaa48c929188a0d169887cc3f16370741467ae49e1db59763f030710a6bbb
MD5 9a0da2692764bb842411a8b9687ebbb7
SHA1 5c3a459faa08a704bdf162476897ad4580ae39bd
SHA512 814d686617df4fe9f50a93dac9428babff3a14836aa27b4666976379ec3fafcab65fd82d8886998fa65e7b59dc192ca067cf8b4cdeb8ef551812912d80dab8ed
SSDEEP 48:apm2+v7BWCLWQqLa7JZ0ZK59HXesxdrqZZSakw6/K:Ymjv7BWoTicJZ0ZKPHXVx1MOw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq48E1.tmp\ioSpecial.ini
Size 707B
SHA256 77014207e3baeb811561a498cfde4acc14ad443da9ddad54b10e7028535c2439
MD5 09d7ca6b5ec89d7cbc30fc8c21cc1435
SHA1 79a14d51176cf411cea379b054d6370b0fe1ced1
SHA512 77b3678bf6145b5d34b1f6a9e57ed02ac3883335e35f2eee5677ec7e510fca91eee39dbd00e5d0e7a9bfb3efe80472f35006d308ca8dac0fda283b36dea17517
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq48E1.tmp\ioSpecial.ini
Size 807B
SHA256 0469566d5eafd63e3516c217965aefc8dc5c842bf2d7d45d65d56f8aaf32b10f
MD5 00bc6c710008b64222e5a29341d61981
SHA1 906821148c18c3d9e2ccc90679964d3a5d9aecef
SHA512 ce52a48e46d374ec7713614ff948e8c21b6622f60b6e376844b0c0587518f467d12637acdaec5081327ca965fee3fa3ac73d8fddbfa886a9473080e82498498a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads