Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 03:08
Static task
static1
Behavioral task
behavioral1
Sample
d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe
Resource
win10v2004-20241007-en
General
-
Target
d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe
-
Size
2.2MB
-
MD5
6232bad0a3bccda0f1c379190fef8929
-
SHA1
3d76146d2ab012f1a6258fbff64627e8d490f0e4
-
SHA256
d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93
-
SHA512
5bc0466271c141883a6e054bbbdd6c11292404cdeb4dd7303a8b0e5bf10485c3bef061044349026080ed6050c93db8e864ebee7819a7b5c26fda058ae41a46e3
-
SSDEEP
49152:8JAKL1A4GFERnJfYMKAUVB7bsxr5fy8ckyyoYXtGqOipLCgvhf:NKL1A4G6nJf9aBHsxr5fy8fy7Y9GqZFd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe -
Executes dropped EXE 6 IoCs
pid Process 3012 SE205.exe 624 SE205.tmp 448 IEMaoSvc.exe 4632 IEMaoSvc.exe 3584 IEMaoSvc.exe 1064 IEMaoSvc.exe -
Loads dropped DLL 11 IoCs
pid Process 368 regsvr32.exe 368 regsvr32.exe 556 regsvr32.exe 3124 regsvr32.exe 3124 regsvr32.exe 1064 IEMaoSvc.exe 1064 IEMaoSvc.exe 1064 IEMaoSvc.exe 1064 IEMaoSvc.exe 1064 IEMaoSvc.exe 1064 IEMaoSvc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0008CBE3-7D12-263A-15FD-39D13B9D1132} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0008CBE3-7D12-263A-15FD-39D13B9D1132}\NoExplorer = "1" regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 IEMaoSvc.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\is-O84Q5.tmp SE205.tmp File opened for modification C:\Windows\SysWOW64\5859585B.fn IEMaoSvc.exe -
Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files (x86)\IEMao\Search\is-L4HII.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-S873D.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-TNJMD.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-U45NM.tmp SE205.tmp File opened for modification C:\Program Files (x86)\IEMao\unins000.dat SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-IM0LN.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-KKIM4.tmp SE205.tmp File opened for modification C:\Program Files (x86)\IEMao\Site.ini SE205.tmp File created C:\Program Files (x86)\IEMao\is-RBU7H.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-7ATCO.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-L0457.tmp SE205.tmp File opened for modification C:\Program Files (x86)\IEMao\iemao.cg IEMaoSvc.exe File created C:\Program Files (x86)\IEMao\Search\is-9HQSA.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-3NDSG.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-LISQK.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-8VEK2.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-E100V.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-R58IJ.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\is-B8HSC.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-GQ032.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-FLLSH.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-JSU5O.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-V6B0Q.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-P5IKT.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-37HAJ.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-EJRTP.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-T6ST4.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\is-1KIKH.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-4PK6L.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-3EB1A.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-VPL2H.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\is-8V1VO.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-38H1Q.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-6SB6S.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-SBI8R.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-GRG99.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-15K5A.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-5S63I.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-R4SAM.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-K6U8D.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-I2SUF.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-81C2P.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-LR004.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-BBHCM.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-ATFO6.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-T7HP8.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-48GOK.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-I2MB8.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-IBD3I.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-RM0IP.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\is-3NMTQ.tmp SE205.tmp File opened for modification C:\Program Files (x86)\IEMao\iemao.cg IEMaoSvc.exe File created C:\Program Files (x86)\IEMao\unins000.dat SE205.tmp File created C:\Program Files (x86)\IEMao\is-7IG4K.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\is-CHUH4.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-OEPL7.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-LG1LU.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-J7CPJ.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-NCIT1.tmp SE205.tmp File created C:\Program Files (x86)\IEMao\Search\is-HFV8K.tmp SE205.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEMaoSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEMaoSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEMaoSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SE205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEMaoSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SE205.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{0008CBE3-7D56-263A-18FD-39D13B9D1165} regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = 68e551004c0000000200000268e55100a20200a04200010100000000c000500000000000609d20766099207600002d01010050000000000011844a7778e839000000000030000000a8a0200230e43c7668844a7714e9390040ad4e770000313a0000ffff9499207600000000000000000b000000940250000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e83900e3cb0800567d3a2618fd39d13b9d116581c901010b0000000b0000004c00000090e8390014e9390040ad4e773781313afeffffffbce839001d794f770000000044794f7770e55100000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400000083a75f4d00240a0204e9390025691376ababababac2a4e776b691376a8a0200220230a0220000000a8a0200201000000d800000020000000a8a0200202000000a400000024e939000e281f02cc2526022a451f0274271f026ce939000f281f0224e9390054e93900c0230a0298240a02c0230a020000000064e939002b2b1f0254e939004a4b1f02010000000000000043da25024bda2502c010a800c0210a0201210a02000000000000000020230a02 regsvr32.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion IEMaoSvc.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DE67902-36AB-4DDD-8785-53AB3E78E9D8}\ProxyStubClsid32 IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DE67902-36AB-4DDD-8785-53AB3E78E9D8}\TypeLib IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFB579ED-8CDF-441A-9900-7EF5D5515383} IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27331A4D-E394-41D3-AB92-2AE3F5A39EEF}\LocalServer32\ = "C:\\PROGRA~2\\IEMao\\IEMaoSvc.exe" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEMaoSv.IEMaoFunc\Clsid\ = "{5E18AC0D-3260-4BD1-B4D1-181FC9F6ACE2}" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D12-263A-15FD-39D13B9D1132}\ = "IEMao" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA33A1D2-892C-4798-8430-50E66C58656A}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ = "IAppServer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Windows\\SysWow64\\midas.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D56-263A-18FD-39D13B9D1165}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFB579ED-8CDF-441A-9900-7EF5D5515383}\ProxyStubClsid32 IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iemao.IEMaoHelper\ = "IEMao" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\CurVer\ = "Borland.Midas_DSCursor.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D56-263A-18FD-39D13B9D1165}\ = "IEèËÑË÷µ¼º½¹¤¾ßÀ¸" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{68F018D4-06B6-465C-B7EA-83AA39D43CC0}\1.0\0\win32\ = "C:\\Program Files (x86)\\IEMao\\IEMaoSvc.exe" IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E18AC0D-3260-4BD1-B4D1-181FC9F6ACE2}\LocalServer32 IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\ = "{83F57D68-CA9A-11D2-9088-00C04FA35CFA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Windows\\SysWow64\\midas.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DE67902-36AB-4DDD-8785-53AB3E78E9D8}\TypeLib\Version = "1.0" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DFB579ED-8CDF-441A-9900-7EF5D5515383}\TypeLib\ = "{68F018D4-06B6-465C-B7EA-83AA39D43CC0}" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA33A1D2-892C-4798-8430-50E66C58656A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D56-263A-18FD-39D13B9D1165}\ = "IEMaoBar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DE67902-36AB-4DDD-8785-53AB3E78E9D8}\TypeLib\ = "{68F018D4-06B6-465C-B7EA-83AA39D43CC0}" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DE67902-36AB-4DDD-8785-53AB3E78E9D8}\TypeLib\ = "{68F018D4-06B6-465C-B7EA-83AA39D43CC0}" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFB579ED-8CDF-441A-9900-7EF5D5515383}\ = "IIEMaoFunc" IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEMaoSv.IEMaoFunc IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Windows\\SysWow64\\midas.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\Clsid\ = "{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID\ = "Borland.Midas_DSCursor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEMaoBar.IEMao Toolbar regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27331A4D-E394-41D3-AB92-2AE3F5A39EEF}\TypeLib IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\CurVer\ = "Borland.Midas_DSBase.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID\ = "Borland.Midas_DSBase" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DatapacketWrite" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E18AC0D-3260-4BD1-B4D1-181FC9F6ACE2}\LocalServer32\ = "C:\\PROGRA~2\\IEMao\\IEMaoSvc.exe" IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DSCursor.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D56-263A-18FD-39D13B9D1165} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D56-263A-18FD-39D13B9D1165}\InprocServer32\ = "C:\\PROGRA~2\\IEMao\\IEMaoBar.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0008CBE3-7D56-263A-18FD-39D13B9D1165}\ProgID\ = "IEMaoBar.IEMao Toolbar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{27331A4D-E394-41D3-AB92-2AE3F5A39EEF}\LocalService = "IEMaoSvc" IEMaoSvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DSBase 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\ = "Borland Midas DatapacketRead" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27331A4D-E394-41D3-AB92-2AE3F5A39EEF}\ProgID\ = "IEMaoSv.BarManage" IEMaoSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\Clsid\ = "{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DFB579ED-8CDF-441A-9900-7EF5D5515383}\TypeLib\Version = "1.0" IEMaoSvc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4168 d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe 448 IEMaoSvc.exe 4632 IEMaoSvc.exe 3584 IEMaoSvc.exe 1064 IEMaoSvc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4168 wrote to memory of 3012 4168 d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe 85 PID 4168 wrote to memory of 3012 4168 d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe 85 PID 4168 wrote to memory of 3012 4168 d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe 85 PID 3012 wrote to memory of 624 3012 SE205.exe 88 PID 3012 wrote to memory of 624 3012 SE205.exe 88 PID 3012 wrote to memory of 624 3012 SE205.exe 88 PID 624 wrote to memory of 448 624 SE205.tmp 89 PID 624 wrote to memory of 448 624 SE205.tmp 89 PID 624 wrote to memory of 448 624 SE205.tmp 89 PID 624 wrote to memory of 368 624 SE205.tmp 90 PID 624 wrote to memory of 368 624 SE205.tmp 90 PID 624 wrote to memory of 368 624 SE205.tmp 90 PID 624 wrote to memory of 556 624 SE205.tmp 91 PID 624 wrote to memory of 556 624 SE205.tmp 91 PID 624 wrote to memory of 556 624 SE205.tmp 91 PID 624 wrote to memory of 3124 624 SE205.tmp 92 PID 624 wrote to memory of 3124 624 SE205.tmp 92 PID 624 wrote to memory of 3124 624 SE205.tmp 92 PID 624 wrote to memory of 4632 624 SE205.tmp 93 PID 624 wrote to memory of 4632 624 SE205.tmp 93 PID 624 wrote to memory of 4632 624 SE205.tmp 93 PID 624 wrote to memory of 3584 624 SE205.tmp 94 PID 624 wrote to memory of 3584 624 SE205.tmp 94 PID 624 wrote to memory of 3584 624 SE205.tmp 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe"C:\Users\Admin\AppData\Local\Temp\d4b7c5e8c0c5488748ad197e36beef284edb85704cdf1c290cb3075c87b34b93.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\SE205.exe"C:\Users\Admin\AppData\Local\Temp\SE205.exe" /VERYSILENT /SP-2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\is-SOV3C.tmp\SE205.tmp"C:\Users\Admin\AppData\Local\Temp\is-SOV3C.tmp\SE205.tmp" /SL5="$602B8,1954047,54272,C:\Users\Admin\AppData\Local\Temp\SE205.exe" /VERYSILENT /SP-3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\is-LARPJ.tmp\IEMaoSvc.exe"C:\Users\Admin\AppData\Local\Temp\is-LARPJ.tmp\IEMaoSvc.exe" U4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:448
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\IEMao\iemao.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:368
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\midas.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:556
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\IEMao\IEMaoBar.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:3124
-
-
C:\Program Files (x86)\IEMao\IEMaoSvc.exe"C:\Program Files (x86)\IEMao\IEMaoSvc.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
C:\Program Files (x86)\IEMao\IEMaoSvc.exe"C:\Program Files (x86)\IEMao\IEMaoSvc.exe" INS C:\Users\Admin\AppData\Local\Temp\SE205.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3584
-
-
-
-
C:\Program Files (x86)\IEMao\IEMaoSvc.exe"C:\Program Files (x86)\IEMao\IEMaoSvc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD54fd418575fc880292165cfe1459698a8
SHA1bce2f459b993b51ea12c995795830250d370a228
SHA256f67fd91b26e2a7965d623bf8c6ab500abb92443a474eec5482eb961864e9d40a
SHA512ae8ce98370eec8fc0eb123e008ca91f5fe8e0247dcf3afdb5d03d8a1947d6fdce0eb685fa28683e286266858baf3ce532acd21fbc39fc867026af0e45b61045a
-
Filesize
648B
MD5c32cd0022b2903bc8e5df113f1a1c6ed
SHA15cc5c6f391b3762fd282f4f2a7f3d218179fb1cd
SHA2563bd51bb4288d9e4626e720a04f8b5d45fa02cea665dcc2c6012a73f8686768af
SHA512ea6b0a9fc9d72cf7ce3790f2a0590812cc309781697f14adb371c5c31dad7e8e6e360f1d54a1e960d71bed7934f2b31ea6e574db49c2af3b30c9e18556464197
-
Filesize
570KB
MD5c8386a40d92c22459e759ffa9410cea3
SHA1248e1f688b439ad774cd5c6e8b4b537b3f337c6d
SHA2564c2aca3c43cc6bcad5ba469efb4492dafefdf865a1d29e062efec220be512dc0
SHA512c18fdcc47632120af36cd814e0e7bd8a1de39a4e77805c6c193f5f3592aefffc9c3c4f7e2f31150872ebdf84f2aac87f2bb14d4eec4c17730b0f67b2c3d9121f
-
Filesize
94B
MD520cf1960ee1824fba9105dff39777924
SHA1d5b88d2b3fb9a85fa93875eeadf62002bd46a94a
SHA2569d82213d961433c00ef5e5d9ee265e5e83801c1706e84b45df5d0d7c072a6d98
SHA51295e10f244f9c05a87812f76b012b1d9f75151b72bda95ee8796ccb4a2e1cf322df0759a4dd5193f0bdc99b86030efa24ff00bf95207db2b62f68cc3e38b6b07a
-
Filesize
764KB
MD5f7ba4f7ed7d31e823ad386e44512220d
SHA1393c9c99eb4e7ae040d38c4cbbeaa4df7d36bf3c
SHA25647dde1ea825b5f0dccc2675404c5f545c25225bde240571965f388a05e6d1be9
SHA512bbeb4c9191f2c3d3d758d1de63573fd7250f38e6493a78518bfc07d993401eea0a88d05c0d9178ab88145489a792de7edc645e875e5d83df1453a43cafa95796
-
Filesize
2.1MB
MD59c4905c83ff4757aa4af814ff541dbff
SHA1bb6e9e6a15762146ecaa518dcacf3cec099030ef
SHA256b28f07326f5b491544b74903e691cb69146398be5c2b209c353acd530c1bc6a1
SHA512ebfd4d124442b45f5ee1b760594149148255900a1a4706f939f16600731db2569167e5ad0cb073af2a4fbd09bda10a2ddc8289ca40c7e5e9c9abbdc0c9cd4d39
-
Filesize
2.6MB
MD54af78d4339b984a67f73c7f38d19b898
SHA15bfe2be35cb0146583c1b8c4ef6ed9080f42a9cf
SHA25636aee391a9711e586c2b92e5a60c106feb593b28735820e8aa1d2fed655d811f
SHA512fb132fca362317d6814448a69068ae99e82c31ce96c3e3a076a6123850ed20610220547a56447308291ebebfa0cfbfc9eae542613e344582bc3eafacfb33b61d
-
Filesize
696KB
MD58aa8c628f7b7b7f3e96eff00557bd0bf
SHA19af9cf61707cbba7bf0d7cbed94e8db91aff8bd6
SHA25614d4fa3ea6c3fbf6e9d284de717e73a1ebb5e77f3d5c8c98808e40ade359ea9d
SHA5125e0a4765873684fce159af81310e37b6918c923ccede0c4de0bd1e2e221425109131830cff02e3f910f15b0401ee3b4ae68700b6d29a5e8466f6d4ee1dcd6eeb
-
Filesize
430KB
MD543b9337ca111defa4da637a3121e7a7d
SHA140f15faa582609408194e2317f14a949388874ef
SHA256e5d2be36e26d90a1926b641e25689ecd9ae4f796bc3ca40ba75b30ef33f67fbf
SHA51225c34deb29fc478c68dd7dd582571025db4cebd9a3d824caa98e9a1f74c1ffea4c983964d9657517d5fc1522efa6e3dbf23224bd24fa215780e39eae13acac60