f5ce49c19ae742a69d61c107520407883f975a1a7584639609c892217081e4a6

General

Target

868fbad52b106fe08c2153d1f270b507.exe
Size

140KB
MD5

868fbad52b106fe08c2153d1f270b507
SHA1

5505e684dc2805cc9fdddb430169a812cb01538f
SHA256

f5ce49c19ae742a69d61c107520407883f975a1a7584639609c892217081e4a6
SHA512

be374828690db11ed918d5f08566b3c5c74685bc75d061697381fe467f7c9ad1e677e102bea6a520a4c292a82370356bc8bbfa9ebc86ab5ab15632ba35edbfae
SSDEEP

3072:V/na9TiG/v3Grddu0UmnEut7C8TrLtUJnIiMO88:V/aTl/v3eTu0UmEutu8/LtnO

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Mmcyck.exeMmcyck.exe

pid process

3336 Mmcyck.exe
3164 Mmcyck.exe

pid	process
3336	Mmcyck.exe
3164	Mmcyck.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

868fbad52b106fe08c2153d1f270b507.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mmcyck = "C:\\Users\\Admin\\AppData\\Roaming\\Mmcyck.exe"	868fbad52b106fe08c2153d1f270b507.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

868fbad52b106fe08c2153d1f270b507.exeMmcyck.exe

description	pid	process	target process
PID 4500 set thread context of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 3336 set thread context of 3164	3336	Mmcyck.exe	Mmcyck.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2846696782"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085810"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2846696782"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D537ABEF-C0E5-11EE-BB4F-F252AA825E28} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2860916179"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413545360"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31085810"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085810"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

868fbad52b106fe08c2153d1f270b507.exe

pid process

2516 868fbad52b106fe08c2153d1f270b507.exe
2516 868fbad52b106fe08c2153d1f270b507.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Mmcyck.exeIEXPLORE.EXE

description pid process

Token: SeDebugPrivilege 3164 Mmcyck.exe
Token: SeDebugPrivilege 4332 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2088 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

2088 IEXPLORE.EXE
2088 IEXPLORE.EXE
4332 IEXPLORE.EXE
4332 IEXPLORE.EXE
4332 IEXPLORE.EXE
4332 IEXPLORE.EXE

pid	process
2516	868fbad52b106fe08c2153d1f270b507.exe
2516	868fbad52b106fe08c2153d1f270b507.exe

description	pid	process
Token: SeDebugPrivilege	3164	Mmcyck.exe
Token: SeDebugPrivilege	4332	IEXPLORE.EXE

pid	process
2088	IEXPLORE.EXE

pid	process
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
4332	IEXPLORE.EXE
4332	IEXPLORE.EXE
4332	IEXPLORE.EXE
4332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

868fbad52b106fe08c2153d1f270b507.exe868fbad52b106fe08c2153d1f270b507.exeMmcyck.exeMmcyck.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 4500 wrote to memory of 2516	4500	868fbad52b106fe08c2153d1f270b507.exe	868fbad52b106fe08c2153d1f270b507.exe
PID 2516 wrote to memory of 3336	2516	868fbad52b106fe08c2153d1f270b507.exe	Mmcyck.exe
PID 2516 wrote to memory of 3336	2516	868fbad52b106fe08c2153d1f270b507.exe	Mmcyck.exe
PID 2516 wrote to memory of 3336	2516	868fbad52b106fe08c2153d1f270b507.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3336 wrote to memory of 3164	3336	Mmcyck.exe	Mmcyck.exe
PID 3164 wrote to memory of 2780	3164	Mmcyck.exe	iexplore.exe
PID 3164 wrote to memory of 2780	3164	Mmcyck.exe	iexplore.exe
PID 3164 wrote to memory of 2780	3164	Mmcyck.exe	iexplore.exe
PID 2780 wrote to memory of 2088	2780	iexplore.exe	IEXPLORE.EXE
PID 2780 wrote to memory of 2088	2780	iexplore.exe	IEXPLORE.EXE
PID 2088 wrote to memory of 4332	2088	IEXPLORE.EXE	IEXPLORE.EXE
PID 2088 wrote to memory of 4332	2088	IEXPLORE.EXE	IEXPLORE.EXE
PID 2088 wrote to memory of 4332	2088	IEXPLORE.EXE	IEXPLORE.EXE
PID 3164 wrote to memory of 4332	3164	Mmcyck.exe	IEXPLORE.EXE
PID 3164 wrote to memory of 4332	3164	Mmcyck.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\868fbad52b106fe08c2153d1f270b507.exe
"C:\Users\Admin\AppData\Local\Temp\868fbad52b106fe08c2153d1f270b507.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\868fbad52b106fe08c2153d1f270b507.exe
  "C:\Users\Admin\AppData\Local\Temp\868fbad52b106fe08c2153d1f270b507.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Roaming\Mmcyck.exe
    "C:\Users\Admin\AppData\Roaming\Mmcyck.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Users\Admin\AppData\Roaming\Mmcyck.exe
      "C:\Users\Admin\AppData\Roaming\Mmcyck.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2780
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
bcace81d477f3c718f9b8caa06bbbdcc

SHA1
966f9283be355a4397633243c28a26ace4f8f5db

SHA256
536e164c1bcbbe417f805d4d9722d6e8d934ee957fb54bb0a1faeb65336f6294

SHA512
99e5175ccc544a20ce6a1d944002ceee21022eee15c9815ec61fa51785480ff43071c239c0fc9ccbeb0a036fe1b7cd62a4f45b1d9e30da7889410e26f747b679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
03fc65e20228469c4871d6fccdc8b015

SHA1
8afa627d7dd20e53a9a9b9e9476b5fd772e72a97

SHA256
a79eb5af40415179f11d00034fb8a27a1ac10c82f89740e03d0e86e9a79e3924

SHA512
96cebfec22df11b4dfb87b6659d358f99d9460b89328e5341214a1def54c88ba11997c16e887f51645fddd9c4ccf0c6c023637c7755534f19809c6f7e581e9eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MCZQJD7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mmcyck.exe

Filesize
140KB

MD5
868fbad52b106fe08c2153d1f270b507

SHA1
5505e684dc2805cc9fdddb430169a812cb01538f

SHA256
f5ce49c19ae742a69d61c107520407883f975a1a7584639609c892217081e4a6

SHA512
be374828690db11ed918d5f08566b3c5c74685bc75d061697381fe467f7c9ad1e677e102bea6a520a4c292a82370356bc8bbfa9ebc86ab5ab15632ba35edbfae

Download Submit
memory/2516-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2516-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2516-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2516-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3164-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3336-13-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/3336-14-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/4500-1-0x0000000002270000-0x0000000002278000-memory.dmp

Filesize
32KB

Download
memory/4500-0-0x0000000002270000-0x0000000002278000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads