698796557066dacb25b80ab17d090dca9822a5a85bc87b2fc43a5c7a336a2891

General

Target

abbcfa031c70a277a81b988878b7b24f.exe
Size

20KB
MD5

abbcfa031c70a277a81b988878b7b24f
SHA1

3044c5ec69ee595ebdd3c40de273614f39bb1748
SHA256

698796557066dacb25b80ab17d090dca9822a5a85bc87b2fc43a5c7a336a2891
SHA512

858465fae8ea99b7b8f6cc7ca797729a0b2312e227aa1648a737a1dd6e8bb48bb5a0533401a375fc20c20ae46aa13038b468040cb558e4121cbf70cfd7003fa5
SSDEEP

384:RNvL5wIjHFfzUZrT1seXmrIyWvWME2B1MAivP:RN5FYVseXjLE41Zi3

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	abbcfa031c70a277a81b988878b7b24f.exe

Executes dropped EXE 1 IoCs

pid	Process
4232	taskmgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\Windows\\system\\taskmgr.exe"	taskmgr.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\N0TEPAD.EXE	taskmgr.exe
File opened for modification	C:\Windows\SysWOW64\N0TEPAD.EXE	taskmgr.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\N0TEPAD.EXE	taskmgr.exe
File created	C:\Windows\N0TEPAD.EXE	taskmgr.exe
File opened for modification	C:\Windows\N0TEPAD.EXE	taskmgr.exe
File opened for modification	C:\Windows\system\windll.dll	taskmgr.exe
File created	C:\Windows\system\taskmgr.exe	abbcfa031c70a277a81b988878b7b24f.exe
File opened for modification	C:\Windows\system\taskmgr.exe	abbcfa031c70a277a81b988878b7b24f.exe
File created	C:\Windows\system\N0TEPAD.EXE	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "about:blank"	taskmgr.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	abbcfa031c70a277a81b988878b7b24f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "N0TEPAD.EXE %1"	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4232	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2120	abbcfa031c70a277a81b988878b7b24f.exe
4232	taskmgr.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3100	2120	abbcfa031c70a277a81b988878b7b24f.exe	99
PID 2120 wrote to memory of 3100	2120	abbcfa031c70a277a81b988878b7b24f.exe	99
PID 2120 wrote to memory of 4232	2120	abbcfa031c70a277a81b988878b7b24f.exe	103
PID 2120 wrote to memory of 4232	2120	abbcfa031c70a277a81b988878b7b24f.exe	103
PID 2120 wrote to memory of 4232	2120	abbcfa031c70a277a81b988878b7b24f.exe	103

C:\Users\Admin\AppData\Local\Temp\abbcfa031c70a277a81b988878b7b24f.exe
"C:\Users\Admin\AppData\Local\Temp\abbcfa031c70a277a81b988878b7b24f.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.18hi.com/
  2⤵
  PID:3100
- C:\Windows\system\taskmgr.exe
  "C:\Windows\system\taskmgr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5364 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1
1⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5676 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5488 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5324 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5976 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6052 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\taskmgr.exe

Filesize
20KB

MD5
abbcfa031c70a277a81b988878b7b24f

SHA1
3044c5ec69ee595ebdd3c40de273614f39bb1748

SHA256
698796557066dacb25b80ab17d090dca9822a5a85bc87b2fc43a5c7a336a2891

SHA512
858465fae8ea99b7b8f6cc7ca797729a0b2312e227aa1648a737a1dd6e8bb48bb5a0533401a375fc20c20ae46aa13038b468040cb558e4121cbf70cfd7003fa5

Download Submit
memory/2120-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2120-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4232-78-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads