9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6

General

Target

b4e634baeecde29b2599537d357f87a7.exe
Size

89KB
MD5

b4e634baeecde29b2599537d357f87a7
SHA1

29ca3fd61d1563184e8c6353520ac2b0b82c81f5
SHA256

9a56d506889bc7c1904d4869a9e21e383a6f66eadc0dd71191cb74d3a2ed20b6
SHA512

c26d975be9a020a11248147526d1bc0733e62e4dee1cf146775cc463419161e9bad886c4a5fe56d4608f03540ce1655abd250d90f1fb2637cc1c597f6b61e64e
SSDEEP

1536:lr9RFbR3XfYFHuI2Zod8+7gTSaSMi9xfQb+ng5aOmTcuOiFeR7Rkxr:fbR3XMuYd8jV5iQb+ngQZhYRV

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow	pid	Process
5	3048	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
3048	powershell.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A82A67A1-0ECB-11EF-9960-CAFA5A0A62FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
3048	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	3048	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
2312	iexplore.exe
2312	iexplore.exe
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b4e634baeecde29b2599537d357f87a7.execmd.exepowershell.exeiexplore.exe

description	pid	Process	procid_target
PID 2172 wrote to memory of 2248	2172	b4e634baeecde29b2599537d357f87a7.exe	28
PID 2172 wrote to memory of 2248	2172	b4e634baeecde29b2599537d357f87a7.exe	28
PID 2172 wrote to memory of 2248	2172	b4e634baeecde29b2599537d357f87a7.exe	28
PID 2172 wrote to memory of 2248	2172	b4e634baeecde29b2599537d357f87a7.exe	28
PID 2248 wrote to memory of 3048	2248	cmd.exe	30
PID 2248 wrote to memory of 3048	2248	cmd.exe	30
PID 2248 wrote to memory of 3048	2248	cmd.exe	30
PID 2248 wrote to memory of 3048	2248	cmd.exe	30
PID 3048 wrote to memory of 2312	3048	powershell.exe	33
PID 3048 wrote to memory of 2312	3048	powershell.exe	33
PID 3048 wrote to memory of 2312	3048	powershell.exe	33
PID 3048 wrote to memory of 2312	3048	powershell.exe	33
PID 2312 wrote to memory of 1764	2312	iexplore.exe	35
PID 2312 wrote to memory of 1764	2312	iexplore.exe	35
PID 2312 wrote to memory of 1764	2312	iexplore.exe	35
PID 2312 wrote to memory of 1764	2312	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\b4e634baeecde29b2599537d357f87a7.exe
"C:\Users\Admin\AppData\Local\Temp\b4e634baeecde29b2599537d357f87a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\oculta.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\oculta.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://server.massgravs.pro/index.php
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oculta.bat

Filesize
158B

MD5
54c2f3a00d5bc5ffd7f5338b8d7e265c

SHA1
5c4086ecf9a3508666b1bd4e27ba8f7a517813be

SHA256
a6aec3bbc95bc0a300857092e35a602c601397eefc8565f2bc42e7e77df1eddb

SHA512
05bf9854e0ba84f12e7ddbaf14886491d98a832ef3287b3affc08079b9d08c88d01c386737a3b3e1d9be3cd8850266bb9ea037269e027209410f1ea6c5cf685c

Download Submit
C:\Users\Admin\AppData\Local\Temp\oculta.ps1

Filesize
1KB

MD5
921c2fb8f2423f9fb469e274eed1d860

SHA1
48bf33a865d9415e514281ecb48ac8e8e43ad4bc

SHA256
ce0bd47287e5b4ebe9de5d050e27e36ba863af9a9b21c52a3e8bc5f135252220

SHA512
31d6a485ff59da843ce4048322d4357ec1eb832b7acb0bff4aa6a9005efdd26be97163cdc5e8da30684ce2b45b72b1b9d02bcec800c7726b26fb52f6dafb16db

Download Submit
memory/2172-2-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2172-1-0x0000000000C60000-0x0000000000C7A000-memory.dmp

Filesize
104KB

Download
memory/2172-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/2172-9-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/2172-10-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads