84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17

General

Target

84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Size

2.0MB
MD5

74a424f627702e6d7e23e15ebfec38d3
SHA1

97301b232a596be888880709e5d161a3ae8dba7f
SHA256

84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17
SHA512

2ed5492f51b0c932582cdd9e6145d74a06b769cdd9194cb74580ba1dd141d0e81879fb942e06413b9fc03be55c8fccdb362943034cc87738efe1dece6ea5f6ed
SSDEEP

49152:qIYwqE82JEer6W5g3eQfhbhayFDpD0f9WYNRXWmk4QS+3IyDPEFx9Yk:LLl86EeumGe2xFDJkPnk4QxIyD4x9Y

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

pid	process
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

pid	process
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

pid	process
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
2724	84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe

C:\Users\Admin\AppData\Local\Temp\84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe
"C:\Users\Admin\AppData\Local\Temp\84f8ecfe961379ebfc0e6d2e431358bb0ef06c8a64c16da20aa335e5f3140d17.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-0-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-1-0x00000000775F0000-0x00000000775F1000-memory.dmp

Filesize
4KB

Download
memory/2724-32-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-33-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-34-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-35-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-36-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-37-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-43-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-51-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-63-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-72-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-79-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-83-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-91-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-100-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download
memory/2724-109-0x0000000000400000-0x0000000000915000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads