b9c4ebecf944e0e9955f86a7581b3b02187ce64e78011035dedab40377ee3001

General

Target

main.exe
Size

20.8MB
MD5

a18229feee8fd2a2d11caf3334962724
SHA1

4c1a078607d9cb97103bfb3122be3b45bdeff817
SHA256

b9c4ebecf944e0e9955f86a7581b3b02187ce64e78011035dedab40377ee3001
SHA512

fc35eb60b4ab3014c680e4fdb2c54eea08ee7480c6c765402985be532d3465bd28317482b0e4f4cd2e69b4691a5a19974e2e8229b1001269fbd189d14b82c37a
SSDEEP

393216:qdjJmE6NrDREnCE8odCMiqwmtD/BFZTFjRUpLHfKg4NMaTSzmGg37P:6JmE6hDOnCE84CMMmt7XepL/KQajGg37

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

main.exe

pid process

3004 main.exe
Loads dropped DLL 2 IoCs

Processes:

main.exemain.exe

pid process

1968 main.exe
3004 main.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3004	main.exe

pid	process
1968	main.exe
3004	main.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

SearchIndexer.exeSearchProtocolHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SearchIndexer.exe

description	pid	process
Token: SeManageVolumePrivilege	1684	SearchIndexer.exe
Token: 33	1684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1684	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

SearchProtocolHost.exeSearchProtocolHost.exe

pid	process
2084	SearchProtocolHost.exe
2084	SearchProtocolHost.exe
2084	SearchProtocolHost.exe
2084	SearchProtocolHost.exe
2084	SearchProtocolHost.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

main.exeSearchIndexer.exe

description	pid	process	target process
PID 1968 wrote to memory of 3004	1968	main.exe	main.exe
PID 1968 wrote to memory of 3004	1968	main.exe	main.exe
PID 1968 wrote to memory of 3004	1968	main.exe	main.exe
PID 1684 wrote to memory of 2084	1684	SearchIndexer.exe	SearchProtocolHost.exe
PID 1684 wrote to memory of 2084	1684	SearchIndexer.exe	SearchProtocolHost.exe
PID 1684 wrote to memory of 2084	1684	SearchIndexer.exe	SearchProtocolHost.exe
PID 1684 wrote to memory of 2144	1684	SearchIndexer.exe	SearchFilterHost.exe
PID 1684 wrote to memory of 2144	1684	SearchIndexer.exe	SearchFilterHost.exe
PID 1684 wrote to memory of 2144	1684	SearchIndexer.exe	SearchFilterHost.exe
PID 1684 wrote to memory of 936	1684	SearchIndexer.exe	SearchProtocolHost.exe
PID 1684 wrote to memory of 936	1684	SearchIndexer.exe	SearchProtocolHost.exe
PID 1684 wrote to memory of 936	1684	SearchIndexer.exe	SearchProtocolHost.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\onefile_1968_133608924096524000\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
2⤵
PID:2144

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:936

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
Filesize
1024KB

MD5
e4e8bd22f7cb41cb482ed6d096f5454a

SHA1
fd9e9fbb155380f3cebd918891f934e7e2b9939f

SHA256
4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7

SHA512
a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1968_133608924096524000\main.exe
Filesize
41.9MB

MD5
d8143edadc864c42daec34549563b607

SHA1
98ce03685f3684cb22ce14e08481f04d3d2959c6

SHA256
d3874a36ed2f12957873843f7b63c80bb36bb22cbb8d4ea08002b0ba228d0f55

SHA512
cac11f6d74097f75888f1604338ade403929e42ee4420853f552bf4d18fba51f79faefadae5751ed218f69c15324a09e2bdf3ff12150c40707b38a2079901cda

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_1968_133608924096524000\python311.dll
Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
memory/1684-180-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/1684-151-0x00000000017B0000-0x00000000017C0000-memory.dmp

Filesize
64KB

Download
memory/1684-135-0x00000000016B0000-0x00000000016C0000-memory.dmp

Filesize
64KB

Download
memory/1684-174-0x0000000002B30000-0x0000000002B38000-memory.dmp

Filesize
32KB

Download
memory/1684-186-0x0000000002B30000-0x0000000002B38000-memory.dmp

Filesize
32KB

Download
memory/1684-188-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/1684-197-0x0000000002B90000-0x0000000002B98000-memory.dmp

Filesize
32KB

Download
memory/1684-204-0x0000000003310000-0x0000000003318000-memory.dmp

Filesize
32KB

Download
memory/1968-134-0x000000013F270000-0x0000000140758000-memory.dmp

Filesize
20.9MB

Download
memory/1968-118-0x000000013F270000-0x0000000140758000-memory.dmp

Filesize
20.9MB

Download
memory/3004-69-0x000000013F2A0000-0x0000000141D3E000-memory.dmp

Filesize
42.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads