17cdbe491e6632b19cd2ff3e7d849065398ab8c865f0c5824b06a608e0346790

General

Target

8e838a072bc5a7dffe12cfa15425a6c1.exe
Size

159KB
MD5

8e838a072bc5a7dffe12cfa15425a6c1
SHA1

aa9e8dfe5cff401e7a10b333307c7c27a738e1c7
SHA256

17cdbe491e6632b19cd2ff3e7d849065398ab8c865f0c5824b06a608e0346790
SHA512

17fa2bc425638ad070e3dac2e0bfef1c5afe314e7af2a58046dfe90a35f30154ba9504b6cc615d083160ccb42f8174b916e295121c85b50722f67a437e9e78e1
SSDEEP

3072:Aja1EwdENasVEPXzbKyHwLR3Rt7qXPQjcU8w3kzDQ:Bd8CPXzbkt7qXPAcU8h/Q

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e838a072bc5a7dffe12cfa15425a6c1.exe

description pid process target process

PID 2360 set thread context of 4908 2360 8e838a072bc5a7dffe12cfa15425a6c1.exe 8e838a072bc5a7dffe12cfa15425a6c1.exe

description	pid	process	target process
PID 2360 set thread context of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086392"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086392"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "305305769"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "326719886"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086392"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3D994080-C32B-11EE-B6AD-72AE6231743A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "305454481"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413795074"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8e838a072bc5a7dffe12cfa15425a6c1.exe

pid process

4908 8e838a072bc5a7dffe12cfa15425a6c1.exe
4908 8e838a072bc5a7dffe12cfa15425a6c1.exe
4908 8e838a072bc5a7dffe12cfa15425a6c1.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8e838a072bc5a7dffe12cfa15425a6c1.exeIEXPLORE.EXE

description pid process

Token: SeDebugPrivilege 4908 8e838a072bc5a7dffe12cfa15425a6c1.exe
Token: SeDebugPrivilege 4276 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

4112 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

8e838a072bc5a7dffe12cfa15425a6c1.exeIEXPLORE.EXEIEXPLORE.EXE

pid process

2360 8e838a072bc5a7dffe12cfa15425a6c1.exe
4112 IEXPLORE.EXE
4112 IEXPLORE.EXE
4276 IEXPLORE.EXE
4276 IEXPLORE.EXE
4276 IEXPLORE.EXE
4276 IEXPLORE.EXE

pid	process
4908	8e838a072bc5a7dffe12cfa15425a6c1.exe
4908	8e838a072bc5a7dffe12cfa15425a6c1.exe
4908	8e838a072bc5a7dffe12cfa15425a6c1.exe

description	pid	process
Token: SeDebugPrivilege	4908	8e838a072bc5a7dffe12cfa15425a6c1.exe
Token: SeDebugPrivilege	4276	IEXPLORE.EXE

pid	process
4112	IEXPLORE.EXE

pid	process
2360	8e838a072bc5a7dffe12cfa15425a6c1.exe
4112	IEXPLORE.EXE
4112	IEXPLORE.EXE
4276	IEXPLORE.EXE
4276	IEXPLORE.EXE
4276	IEXPLORE.EXE
4276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

8e838a072bc5a7dffe12cfa15425a6c1.exe8e838a072bc5a7dffe12cfa15425a6c1.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 2360 wrote to memory of 4908	2360	8e838a072bc5a7dffe12cfa15425a6c1.exe	8e838a072bc5a7dffe12cfa15425a6c1.exe
PID 4908 wrote to memory of 2968	4908	8e838a072bc5a7dffe12cfa15425a6c1.exe	iexplore.exe
PID 4908 wrote to memory of 2968	4908	8e838a072bc5a7dffe12cfa15425a6c1.exe	iexplore.exe
PID 4908 wrote to memory of 2968	4908	8e838a072bc5a7dffe12cfa15425a6c1.exe	iexplore.exe
PID 2968 wrote to memory of 4112	2968	iexplore.exe	IEXPLORE.EXE
PID 2968 wrote to memory of 4112	2968	iexplore.exe	IEXPLORE.EXE
PID 4112 wrote to memory of 4276	4112	IEXPLORE.EXE	IEXPLORE.EXE
PID 4112 wrote to memory of 4276	4112	IEXPLORE.EXE	IEXPLORE.EXE
PID 4112 wrote to memory of 4276	4112	IEXPLORE.EXE	IEXPLORE.EXE
PID 4908 wrote to memory of 4276	4908	8e838a072bc5a7dffe12cfa15425a6c1.exe	IEXPLORE.EXE
PID 4908 wrote to memory of 4276	4908	8e838a072bc5a7dffe12cfa15425a6c1.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\8e838a072bc5a7dffe12cfa15425a6c1.exe
"C:\Users\Admin\AppData\Local\Temp\8e838a072bc5a7dffe12cfa15425a6c1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\8e838a072bc5a7dffe12cfa15425a6c1.exe
  C:\Users\Admin\AppData\Local\Temp\8e838a072bc5a7dffe12cfa15425a6c1.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4112 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
52bfc02b370f1b48b834ce1c58ad6560

SHA1
d3dbca3ed04caabf69ec8d525a83cde0919809cf

SHA256
fce02a7cb2ed194e21949d8a394e69f1dd30c4c517addc831018b8a0b7235a97

SHA512
5fb4c1b2d4173f5de1237e2fd55b9081b99756217d5d639da3e0e1bbe339d87be2e9b732ef783446bdedee2af8730e4bedb3184d58ba0bce0881ddc199495289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
141c7802a3a301feb5a66cd714ed9256

SHA1
491d52e6dcd815d73b741be67703257a6bac395d

SHA256
4b59a3e1070bc59e2610b9601dc69d0af215b2cae71b07f69d3a11bff72be063

SHA512
f33cba09cf722be94f1b91ce0606d5708fadc54480129505f29577177b3fb64aef7f7f22170eca8111fab90701d415a32a8521e740cfbb5126245dd551f02da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8F18HYR\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
memory/2360-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2360-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4908-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4908-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4908-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4908-8-0x00000000022B0000-0x00000000022FE000-memory.dmp

Filesize
312KB

Download
memory/4908-10-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing