34353d841c7d7e7ec85f8ebb40b78e983e352c6432b851c7c304c13482776c75

Analysis

max time kernel
149s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f19e44dc132b347a832901cc15caf21.dll
Size

200KB
MD5

9f19e44dc132b347a832901cc15caf21
SHA1

41ca6d640e185da276f3f9fb3c15a79115079b43
SHA256

34353d841c7d7e7ec85f8ebb40b78e983e352c6432b851c7c304c13482776c75
SHA512

e1abcbf682fcacec332cafe8015ac0db19a84257f334bdd09a2e88099251ece3b341a562a723739323461685df0b07241608733aa967016b1fcfa693c35cef99
SSDEEP

6144:PT4iMY1gO7+QpRAUOldWeYA+m6Bz64GoWBmVu9oS:Pd1gOaQpRKWth64LWB6u9oS

Score

8^/10

evasion upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2232-1-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2320-11-0x0000000001FA0000-0x0000000002002000-memory.dmp	upx
behavioral1/memory/3028-15-0x00000000008A0000-0x0000000000902000-memory.dmp	upx

Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs

Modify Registry

T1112

Processes:

notepad.exerundll32.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

rundll32.exenotepad.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exeiexplore.exerundll32.exeIEXPLORE.EXEnotepad.exenotepad.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414208918"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000dfd4df3845de9bd386948b2d95b39a2ec355fa0ef6a369e1ef080ff1d6ff2116000000000e800000000200002000000003c361cc25ad708651783a25c50129df60d213ca2916b75a46cb3abd5d0ed206200000005342560915b0380ef1c661adfa9f2359dfdfe7fdf566563fe5f1f4d6a8d6c1b8400000005a3ba899bce53a128b45e4bd5466590de0f1eeb3fea50158b25e3561b34f8984904b147252d6e6cef12884e9f1bc57b2874c0ddeb44f9cd8cb684c07f88a2486	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0294ff27760da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04B7EE51-CC6B-11EE-ADCE-5E44E0CFDD1C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c277bcba8eb2bbe60f69bd23a1445567f28c6c1a3a75076b2bbe1da7363992cd000000000e800000000200002000000009197ed726713ccb58ff97152eeacfe24dd48b121c26009fb788b3c06613fa67900000002020cd17e610be3bc4f6b0bd5542c74c420068e848af822d40855c5c58ad05290332f6441d8c37032ad7fd4292ac675c5f10930a37db729de57b89c4bb0dd74c13408f99407ff50acc41667fcae23cf7bd31cbeee1dba85d48c8773ac4c1dab040e59207fa8386ca70cb2a1d041db8b1d505763fa1c1b748aa10ab41a99d8d0d8a443f2d38a9e9f5d3970a95408f3baf4000000003ad059e2a477b851830abdb36d9d6e6511f5de986873d0bca0c9ca6262584ed36b717e7bdf51cb6f8e3a0758247cd28b46d41f5fd4a51fd82678a21e5a8216b	iexplore.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exenotepad.exenotepad.exe

pid	process
2232	rundll32.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
3028	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2232	rundll32.exe
2232	rundll32.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe
2320	notepad.exe

Suspicious use of FindShellTrayWindow 13 IoCs

Processes:

iexplore.exectfmon.exe

pid	process
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2580	iexplore.exe
2164	ctfmon.exe
2164	ctfmon.exe
2164	ctfmon.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2580 iexplore.exe
2580 iexplore.exe
2620 IEXPLORE.EXE
2620 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeiexplore.exe

description	pid	process	target process
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2888 wrote to memory of 2232	2888	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1968	2232	rundll32.exe	explorer.exe
PID 2232 wrote to memory of 1968	2232	rundll32.exe	explorer.exe
PID 2232 wrote to memory of 1968	2232	rundll32.exe	explorer.exe
PID 2232 wrote to memory of 1968	2232	rundll32.exe	explorer.exe
PID 2232 wrote to memory of 2320	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 2320	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 2320	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 2320	2232	rundll32.exe	notepad.exe
PID 2900 wrote to memory of 2164	2900	explorer.exe	ctfmon.exe
PID 2900 wrote to memory of 2164	2900	explorer.exe	ctfmon.exe
PID 2900 wrote to memory of 2164	2900	explorer.exe	ctfmon.exe
PID 2232 wrote to memory of 2320	2232	rundll32.exe	notepad.exe
PID 2580 wrote to memory of 2620	2580	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2620	2580	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2620	2580	iexplore.exe	IEXPLORE.EXE
PID 2580 wrote to memory of 2620	2580	iexplore.exe	IEXPLORE.EXE
PID 2232 wrote to memory of 3028	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 3028	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 3028	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 3028	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 3028	2232	rundll32.exe	notepad.exe
PID 2232 wrote to memory of 2580	2232	rundll32.exe	iexplore.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f19e44dc132b347a832901cc15caf21.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f19e44dc132b347a832901cc15caf21.dll,#1
2⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1968

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\system32\ctfmon.exe
ctfmon.exe
2⤵
- Suspicious use of FindShellTrayWindow
PID:2164

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
400d6a78c9fbfa7c837d296fa1a3db33

SHA1
4e49ee974ca0d00fc774349b85a627306405102c

SHA256
4a6d893a9d7c97891c3efc75b1e51c6d151f5bd153ff1b8f667f706f285f57b8

SHA512
a077a94db3746d9353138680f6cbbc5fb43718bb6dbaf1c3579d7f1cf8c79259cacead46df15ea809436e4eddff645c43f46ee1be910aa543cb042f90e62680e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cbfd58f844a3792471b0e4f6de3e39b9

SHA1
8e35cdaf21493c8462e0de59eaf69596dd7fa2ac

SHA256
3373763914984b763505c410d39a9bd4bb94690063da7a7c79b13e8f03941bef

SHA512
b842d8abe682b9d43ce750fc69ed9cf8c3bfe1b394b41bb1e664eb24897628e7d7631d86108e0122c76f0127c0a139d416299040755d58fce6ee5e90e33ef311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eb635af4bb96889d7e1a6ab96c4188ca

SHA1
096984d0d8cdb0e13484b546012e874f1c9cab9f

SHA256
9bca5de8bdc3b0c2511409d1cbe7afce3c710f0c9b706e35d1519c023446377f

SHA512
e064f8b30706bba3bbf9eb185b50ec22a62bbf22c2017fa0eaa0d3e55e4ee31f78a44a5613936efd03ce8ee6e151f777c6115bb6ed5325d1074ea09baf916e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
505f7a420ef315247b4ef8faa77aafe3

SHA1
f7a682292f78b804ef1baba6709134720420a009

SHA256
64a16dbb08b084607c7f0fcf6d0f7753141e38deebeb1b2734f9060f2b978120

SHA512
32080eb3a5621bdfb303f116bef4879667a247338c6d5c71aed9b4ca7b6a2366fe9598781871186b46053e0b64b298a76bd9af5c992ed36f1dedfe8a1db4edde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
613c93f5a15bbadc368bc38359713008

SHA1
11ea16c10eb028ef45b5a129a10f1cc7b39a36c2

SHA256
1ea757db45f58cc196070630003a19ea251b1ff979f9a8424829e4739701e3c1

SHA512
10f6cecc4ab9ecc702fd3514f8cbd5f732364320cc8f7f4a74248984649cc5194911d81a282b2d133fda9594a90c7d81ae743e2219afb7083079c0c5b9af097b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0da393a89c529a993c2332bbb80cae1f

SHA1
382f51ac4f14cfa3e68f06b0d4431a66d665c725

SHA256
b9b2a5fe6a122a67c1200aad6a4ce7649ee531ba4fda9f8421e8439814a067df

SHA512
2f29200095a0b2217178089c6735417556b81289d0150614831b8db9bba708ab4fdb8d7bb166e11b1d4ee421c66a8d09c084cc5030b0750d0e17f9669c927665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bb0f7d8b9946c0128aca87ec2142bc93

SHA1
e391a20280546ca11833b35adecfedfd2004e0fc

SHA256
3fdef27962fef762ba76cdc4815c4d9ebc414263ac5de14793e40bf0ece3dfb5

SHA512
430c0b9cd16294c69fb69dab062e5d503c74d701df6acfd96d55c2a1fa1953ed17482befcc62f76cdda200cd4a6e5bcdee89610b1455bfe5e85ef55ad883dea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d139b6df3034e8f9c2e77184e2f508aa

SHA1
975d3223ce4b879160439f7283273d0fd9dea31b

SHA256
cd08a815573b8458b838210860299e96f62b19567a3d87c2ba2cb4c3074870d6

SHA512
2988b46c40f55dbba313a6b07b8fa3a4a67271832aef48bc582abfdadbf0de970de8f83599e22984b9c593bea7d7a6af9dbd31db2f70cee6274e2f78465312a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0f533bad181e519528066de615ad4759

SHA1
a11fc3cc8d64f6e74b1d56b244827a30cad5a696

SHA256
f51b7bb535ac723143b4ba1b0793acc77df984ee04c28dd98a322e573a1e57ae

SHA512
4e1e4316a575e2b9667a79c9a5719e5f111a36e5a37fd33f0587f284a10fc5be170f4721f69026cbe4cffdd3c19007d6d33b20652a42effd36f3b533910e4211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3a6efca3f8f416a510b0195f3dbca3b8

SHA1
367825004dbb818c2325691c506f9aff15dc4361

SHA256
280a2b81da4e47785bdcbd058b850dc73f370d400b41d94733a8391d20c33752

SHA512
83c7d28e96109fccf416119c09caaafa3a931b5fe2d0acf96714c04ae2131b8e777279dd2d566de549f8467dba32464025cd994bc46e6d38c236a8f9bf511bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a059c074dc3d8d003479d77716859d00

SHA1
7eafabe4899b261b767dd0c6366e55340d598216

SHA256
c1cfe60b59d4d3b19b4cd80f9923a80f0496571d37b4165daf3e4722f41ec5b4

SHA512
f93982800cb5394e8fa4b704bc79b6b90268fdba0eedb196b254ca903b46af5c620db96b6fc96b5aa93b2615ff8eb48fc71cf6a31cccfab0a1796e855031f6c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3acbcf5e98ac25d0a4aae15a6559a6ed

SHA1
9fc6c3930fedc22dd21cbcde69b9ca7899e47435

SHA256
dfb675346877d519e100968186e43f134cefc2e1ae2e5766c8a1c8132fc7a56d

SHA512
3a69b40d07fbd9f2e33ab1c945e581923f8ac678fabc95472c76bfd4b0138ba1f617efc24533e2f785f7eac15a02fbb726d34b6852a4d4d8a45c63edf2c0a8a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
afb2ac32f7294ec1605fb4a3f5f2659d

SHA1
fc34facb8d99dc38533ff1f2899da107be6d12c7

SHA256
8f26d00f40955d87792b8fd0e4c4953ea1a2376e26bde8f739f636565a591ea9

SHA512
2d5c3afd507008c7424479c621e03a2ee99ebd97943b546cc34b476ba5ebd5b1bfa5d82eb35b27e12a1f690e34598bf01023130661d4b6a5a16d735bbc5d4f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9cc6be395121fc0f178cc7bb2046aa62

SHA1
c603cb43e4e2d528ffa409dd4b5108b42dcdc158

SHA256
641d3f7d90318eab9275ce706fdfdc53b9ee373691a2d00efe5395152e53a49a

SHA512
e977fac8e66683c4e53be81644d17a222228ca49ef2b35bc88fde642896cf49cfd47744c4591ea065a7f7fc7e76c0d00700e5cef5898477678be89117ae6ef40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b146237ab24db4e513ae3b61b5d188aa

SHA1
e1a3f6955dbb39a7712fc3c029d23e5573f3ebf5

SHA256
d9f02bd9ff5bef528a82c9a4c2cd6a3e56468a17a19f51f7e8573a6b6df9da5b

SHA512
68e197723974eb3ee381da930b30d2f610b874afe4360e0e676061fbf5892ce294a596bf64ad2764f264b88ba0dd153ec702ea796fba77555daf18ced30b975d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6c8540e5aac9e47200261f6c498d4f4f

SHA1
64f51c26c3c5c7e165e7ff1692ddd916e677a333

SHA256
1b311f028d24083147d06a4e1d0a04a10334d4b2ca22b2b0e12c9f29b89fac01

SHA512
a8074443fffa8038390c5b1917cb3f9fef95860f81ad12f4199a6f627ea2a3d1f499cb5a0eb73bcce9dcc78641cbb384df145eff4c58cc4bf193022d12941ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ac7a2a3a203fd12baf2c90cd4475a704

SHA1
dab9e419b956d5671d30fef7336d66e05b34633b

SHA256
66df7b62abb610ab6299c7c1bcf248d5cbc9c5ed5edd8ee935362686563dd9e8

SHA512
17bc8cd22a2bac2ed82b0c71ab9e3f3e3649a10da7aa0ef92d0be82b9ef419c1a8021363011d86810b93038ff058b6757c1c1cff1b1a8431e7e25870ddd31ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e6f7e41f124d5e274e36f2ef90908aaf

SHA1
caff08b29d40a2254055fd2c0273fa4365abba2e

SHA256
cc322f4e9736831c4a9b1fa3af1ddbfb7409a65267d012dc475471ba98688c35

SHA512
f0bf597bdccafcdb9a5bbddc8b50590fee2d8d10b21d08a4fc9b017ca4e90489c52b0ea3a4f16f177f66af466b77b92f45d2c8277c3cfda4d7eec1707f6ce133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
031460de4c20eeac1e289ab43a222112

SHA1
d4a2039bbaf50eefc5d6c03e7e08a50442fd18e4

SHA256
a0470e93a005138c84ef06a7f56ced7a5b296bba14d311359d3019d3d5881db8

SHA512
9329c4098f6975823ed39d5b81bcd3c02efc6590a3c6426b3ff8ed68a8565383ab661f673cdc4aa9a42cc2c19187efc7e59247bf9c763bfc2ace2a6d8bb1a326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8604319f5f9c3c595aededa86defd500

SHA1
c377720d417b1875e66d8278d925bb360e0c099f

SHA256
10d199c94dd4ff0b8b4de21d4fbc44d2531ff500b0509c74d4df32333204b2c0

SHA512
1466bd268cfae35a3091d5a5c89bb7c2f7c828f742115ba1d6989b25c355aef42613d60a2f99bea501bf644079ac8e6b6a4c3ba4a5ac7e66ac5bedf0588960ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
d532af3a40bc2dd440ce7dd8284341e1

SHA1
179ee4c3cf4cf65bb6b4aaef40959b568ceef52f

SHA256
7032cd98efb66920d0c7c3f61490776c96dd2cda66809a87f60288f2e7fd61be

SHA512
8dd870b8d20bed0aeeafc28834266c4bd94e636a7aad8a30b9991e8d05dd16bc435ebdd4e9c2a62c19339d2cfc573988c1aaa34e2539147b0c195eddfbef63fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC8CC.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA09.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2232-5-0x00000000001B0000-0x00000000001C4000-memory.dmp

Filesize
80KB

Download
memory/2232-2-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2232-3-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2232-4-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2232-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2232-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2320-9-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2320-17-0x0000000001FA0000-0x0000000002002000-memory.dmp

Filesize
392KB

Download
memory/2320-11-0x0000000001FA0000-0x0000000002002000-memory.dmp

Filesize
392KB

Download
memory/2320-12-0x0000000001FA0000-0x0000000002002000-memory.dmp

Filesize
392KB

Download
memory/2320-13-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2900-19-0x0000000003B00000-0x0000000003B01000-memory.dmp

Filesize
4KB

Download
memory/2900-7-0x0000000003B00000-0x0000000003B01000-memory.dmp

Filesize
4KB

Download
memory/2900-8-0x0000000003B10000-0x0000000003B20000-memory.dmp

Filesize
64KB

Download
memory/3028-18-0x00000000008A0000-0x0000000000902000-memory.dmp

Filesize
392KB

Download
memory/3028-16-0x00000000008A0000-0x0000000000902000-memory.dmp

Filesize
392KB

Download
memory/3028-15-0x00000000008A0000-0x0000000000902000-memory.dmp

Filesize
392KB

Download