2a471b97ddb0c6d855494b688ddee4f3398eca2dccc7b54d8578318f7d770da5

General

Target

e19880b4ed3babf34b581f9958019b9c.exe
Size

408KB
MD5

e19880b4ed3babf34b581f9958019b9c
SHA1

560aea3c82754e3543c8d513090c96631594de11
SHA256

2a471b97ddb0c6d855494b688ddee4f3398eca2dccc7b54d8578318f7d770da5
SHA512

eb826eddb594a9a24a7299b8596cf83e6a9cf712b055d25722b196c3b9ecfa0381de37d30c861ec0e3db22a825492ff88eb417c8c0a0e9d40799881ec02352cd
SSDEEP

6144:WZMkgViyFcN2K533wr1S01+X1hi5xKd8PZrzTGUteH2mZJzTIXFoCPcAC:rVi7X338w01Yni+GPlzTB0Hb+FoZx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{03650ADB-DDC4-4F6F-BFC1-AE81E5F824F2}	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{03650ADB-DDC4-4F6F-BFC1-AE81E5F824F2}\AppName = "mkupdater.exe"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{668F8B2E-8C37-4C38-A78E-8CB206AB0C1F}\AppName = "mkbho.dll"	e19880b4ed3babf34b581f9958019b9c.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{225C1D71-13D3-4452-B235-85199A3C29C2}	e19880b4ed3babf34b581f9958019b9c.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	e19880b4ed3babf34b581f9958019b9c.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{03650ADB-DDC4-4F6F-BFC1-AE81E5F824F2}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Mini Search (M)\\"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{668F8B2E-8C37-4C38-A78E-8CB206AB0C1F}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Mini Search (M)\\"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{668F8B2E-8C37-4C38-A78E-8CB206AB0C1F}\Policy = "2"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{225C1D71-13D3-4452-B235-85199A3C29C2}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Mini Search (M)\\"	e19880b4ed3babf34b581f9958019b9c.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{109AA1F9-DCC0-4744-B82F-3A29515AAAD9}	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{109AA1F9-DCC0-4744-B82F-3A29515AAAD9}\AppName = "msengine.dll"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{109AA1F9-DCC0-4744-B82F-3A29515AAAD9}\Policy = "2"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{03650ADB-DDC4-4F6F-BFC1-AE81E5F824F2}\Policy = "2"	e19880b4ed3babf34b581f9958019b9c.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{668F8B2E-8C37-4C38-A78E-8CB206AB0C1F}	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{225C1D71-13D3-4452-B235-85199A3C29C2}\AppName = "mkbar.dll"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{225C1D71-13D3-4452-B235-85199A3C29C2}\Policy = "2"	e19880b4ed3babf34b581f9958019b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{109AA1F9-DCC0-4744-B82F-3A29515AAAD9}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Mini Search (M)\\"	e19880b4ed3babf34b581f9958019b9c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2032	1452	e19880b4ed3babf34b581f9958019b9c.exe	97
PID 1452 wrote to memory of 2032	1452	e19880b4ed3babf34b581f9958019b9c.exe	97
PID 1452 wrote to memory of 2032	1452	e19880b4ed3babf34b581f9958019b9c.exe	97

C:\Users\Admin\AppData\Local\Temp\e19880b4ed3babf34b581f9958019b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e19880b4ed3babf34b581f9958019b9c.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /u /s "msengine.dll"
  2⤵
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-0-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/1452-1-0x0000000000570000-0x0000000000573000-memory.dmp

Filesize
12KB

Download
memory/1452-2-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1452-3-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/1452-4-0x0000000000570000-0x0000000000573000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing