12b58d53ddc77d81ea3de8f7761ba36e552e57f5c3c95853799f3e8d4e72876f

General

Target

d5b6a309b12a2f0a185207da2adadd3d.exe
Size

471KB
MD5

d5b6a309b12a2f0a185207da2adadd3d
SHA1

a3e52897f14cacbc0da9f7053a4ac302a165cb14
SHA256

12b58d53ddc77d81ea3de8f7761ba36e552e57f5c3c95853799f3e8d4e72876f
SHA512

e617090d3a42eae06760e3af60368cd8fc6903246db671a1c208e6fba63539b1c7a6a730b403bf03205cfed59959abf7c3d3423a52b66c5593835d2a2179f126
SSDEEP

6144:Ww0uS4HrtXRGPRX2YIe4GQYMb9bn6DtcvW4LHJ2SkArBylSD:jA4ZX4Jae4GRMRmpRKp2S5Bp

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1356	Explorer.EXE

Loads dropped DLL 1 IoCs

pid	Process
2928	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\FohaJahx = "regsvr32.exe \"C:\\ProgramData\\FohaJahx\\XicmUxkip.inf\""	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\FohaJahx = "regsvr32.exe \"C:\\ProgramData\\FohaJahx\\XicmUxkip.inf\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2928	regsvr32.exe
Token: SeDebugPrivilege	2928	regsvr32.exe
Token: SeCreateGlobalPrivilege	1356	Explorer.EXE
Token: SeShutdownPrivilege	1356	Explorer.EXE
Token: SeDebugPrivilege	1356	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2008	d5b6a309b12a2f0a185207da2adadd3d.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2008 wrote to memory of 2928	2008	d5b6a309b12a2f0a185207da2adadd3d.exe	28
PID 2928 wrote to memory of 940	2928	regsvr32.exe	17
PID 2928 wrote to memory of 940	2928	regsvr32.exe	17
PID 2928 wrote to memory of 1356	2928	regsvr32.exe	21
PID 2928 wrote to memory of 1356	2928	regsvr32.exe	21
PID 2928 wrote to memory of 2312	2928	regsvr32.exe	25
PID 2928 wrote to memory of 2312	2928	regsvr32.exe	25

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:940

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1356
- C:\Users\Admin\AppData\Local\Temp\d5b6a309b12a2f0a185207da2adadd3d.exe
  "C:\Users\Admin\AppData\Local\Temp\d5b6a309b12a2f0a185207da2adadd3d.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\\~0F765725.tmp"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2928

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~0F765725.tmp

Filesize
380KB

MD5
4dde5b5c9f67f6f8df25d5a1d53601ae

SHA1
4a85954ff0dcbf7c464d2a52bf8fee06e51e06dc

SHA256
c7161db7161d34d3ab5757f5c60e683535c92e0f20747b6de60ed2f53943eced

SHA512
1ef4aa864711a781a30f5e2ef572d9f854b5661b4ab748a788ad05a235d78fead3843cc0e08e3981f5b60cd3cd21416e9ebcd155ba481c1ae9f0c2233bec1eec

Download Submit
memory/940-18-0x0000000001D00000-0x0000000001D58000-memory.dmp

Filesize
352KB

Download
memory/1356-22-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1356-27-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1356-31-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1356-21-0x00000000778E0000-0x00000000778E1000-memory.dmp

Filesize
4KB

Download
memory/1356-26-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1356-29-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1356-23-0x0000000002670000-0x00000000026C8000-memory.dmp

Filesize
352KB

Download
memory/2008-7-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2008-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-3-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2008-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2928-14-0x0000000000440000-0x0000000000442000-memory.dmp

Filesize
8KB

Download
memory/2928-10-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2928-11-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2928-30-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads