flawedammyy | fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f

Processes:

flawedammyy.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinTech client = "C:\\Program Files (x86)\\SinTech\\TextEdit.exe"	flawedammyy.exe

Drops file in Program Files directory 2 IoCs

Processes:

flawedammyy.exe

description	ioc	Process
File created	C:\Program Files (x86)\SinTech\TextEdit.exe	flawedammyy.exe
File created	C:\Program Files (x86)\SinTech\TextEdit.exe.config	flawedammyy.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid	Process
2568	sc.exe
3692	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs

Modify Registry

Processes:

flawedammyy.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	flawedammyy.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

flawedammyy.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	flawedammyy.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeflawedammyy.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShown = "1"	flawedammyy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOncePerInstallCompleted = "1"	flawedammyy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceCompletionTime = f84268cb0c09d401	flawedammyy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	flawedammyy.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	flawedammyy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown = "1"	flawedammyy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4AC142E7-D701-11EE-B09F-E27D0092C90A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Recovery	flawedammyy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	flawedammyy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP = 232ab69ccc22d401	flawedammyy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShownTime = f84268cb0c09d401	flawedammyy.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main	flawedammyy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exe

pid	Process
4412	iexplore.exe
4412	iexplore.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

flawedammyy.execmd.exeiexplore.exe

description	pid	Process	procid_target
PID 208 wrote to memory of 5096	208	flawedammyy.exe	91
PID 208 wrote to memory of 5096	208	flawedammyy.exe	91
PID 208 wrote to memory of 916	208	flawedammyy.exe	92
PID 208 wrote to memory of 916	208	flawedammyy.exe	92
PID 208 wrote to memory of 916	208	flawedammyy.exe	92
PID 916 wrote to memory of 2568	916	cmd.exe	94
PID 916 wrote to memory of 2568	916	cmd.exe	94
PID 916 wrote to memory of 2568	916	cmd.exe	94
PID 916 wrote to memory of 3692	916	cmd.exe	95
PID 916 wrote to memory of 3692	916	cmd.exe	95
PID 916 wrote to memory of 3692	916	cmd.exe	95
PID 916 wrote to memory of 1884	916	cmd.exe	96
PID 916 wrote to memory of 1884	916	cmd.exe	96
PID 916 wrote to memory of 1884	916	cmd.exe	96
PID 4412 wrote to memory of 3580	4412	iexplore.exe	100
PID 4412 wrote to memory of 3580	4412	iexplore.exe	100
PID 4412 wrote to memory of 3580	4412	iexplore.exe	100
PID 916 wrote to memory of 2196	916	cmd.exe	101
PID 916 wrote to memory of 2196	916	cmd.exe	101
PID 916 wrote to memory of 2196	916	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\flawedammyy.exe
"C:\Users\Admin\AppData\Local\Temp\flawedammyy.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer Automatic Crash Recovery
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\SinTech\TextEdit.exe
  "C:\Program Files (x86)\SinTech\TextEdit.exe"
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed" & sc description Wlanspeed "Wlanspeed service" && netsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe" && netsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SysWOW64\sc.exe
    sc create Wlanspeed binpath= "C:\ProgramData\Wlanspeed\wlanspeed.exe -service" start= auto displayname= "Wlanspeed"
    3⤵
    - Launches sc.exe
    PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc description Wlanspeed "Wlanspeed service"
    3⤵
    - Launches sc.exe
    PID:3692
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Wlanspeed" dir=in action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"
    3⤵
    - Modifies Windows Firewall
    PID:1884
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Wlanspeed" dir=out action=allow profile=any description="Wlanspeed service" program="C:\programdata\Wlanspeed\wlanspeed.exe"
    3⤵
    - Modifies Windows Firewall
    PID:2196
- C:\ProgramData\Wlanspeed\wlanspeed.exe
  "C:\ProgramData\Wlanspeed\wlanspeed.exe" -getid -nogui
  2⤵
  PID:3384

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1720

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4412 CREDAT:17410 /prefetch:2
  2⤵
  PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery