2b8072cf7b0c14a4f9c662d66cf5f6a64c7defb73fb6b0fcc9cd5d32ff004101

General

Target

Chemicals Genaral presentation.exe
Size

284KB
MD5

9ef7a2253f269a14bf170f4a60a97538
SHA1

3e92a77ad4e208a678d5f0ccdd5bba0a9c08ecbb
SHA256

2b8072cf7b0c14a4f9c662d66cf5f6a64c7defb73fb6b0fcc9cd5d32ff004101
SHA512

41d1c0ffc87401c59c072126dd47de7cd2839fbd032c1c37781edac2c67d6ef818f3a86d42418a72afa2f447127a64e9a093ca9d8052557225843ba223650fda

Score

10^/10

evasion trojan persistence spyware

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

iexplore.exeiexplore.exe

description pid process

Token: SeDebugPrivilege 752 iexplore.exe
Token: SeDebugPrivilege 1508 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	752	iexplore.exe
Token: SeDebugPrivilege	1508	iexplore.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1508-14-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1508-16-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1508-17-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1844-25-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1844-27-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1844-28-0x0000000000400000-0x0000000000416000-memory.dmp	upx

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Chemicals Genaral presentation.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chemicals Genaral presentation.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Chemicals Genaral presentation.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	Chemicals Genaral presentation.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Chemicals Genaral presentation.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chemicals Genaral presentation.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8 = "C:\\Users\\Admin\\AppData\\Roaming\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8.exe"	iexplore.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 65 IoCs

Processes:

Chemicals Genaral presentation.exeChemicals Genaral presentation.exeiexplore.exe

description	pid	process	target process
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 1316 wrote to memory of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 108 wrote to memory of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1508	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1384	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1824	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1844	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe
PID 752 wrote to memory of 1328	752	iexplore.exe	iexplore.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

Chemicals Genaral presentation.exeChemicals Genaral presentation.exeiexplore.exe

description	pid	process	target process
PID 1316 set thread context of 108	1316	Chemicals Genaral presentation.exe	Chemicals Genaral presentation.exe
PID 108 set thread context of 752	108	Chemicals Genaral presentation.exe	iexplore.exe
PID 752 set thread context of 1508	752	iexplore.exe	iexplore.exe
PID 752 set thread context of 1384	752	iexplore.exe	iexplore.exe
PID 752 set thread context of 1824	752	iexplore.exe	iexplore.exe
PID 752 set thread context of 1844	752	iexplore.exe	iexplore.exe
PID 752 set thread context of 1328	752	iexplore.exe	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Chemicals Genaral presentation.exeiexplore.exe

pid process

108 Chemicals Genaral presentation.exe
752 iexplore.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Chemicals Genaral presentation.exe

pid process

108 Chemicals Genaral presentation.exe
108 Chemicals Genaral presentation.exe

pid	process
108	Chemicals Genaral presentation.exe
752	iexplore.exe

pid	process
108	Chemicals Genaral presentation.exe
108	Chemicals Genaral presentation.exe

C:\Users\Admin\AppData\Local\Temp\Chemicals Genaral presentation.exe
"C:\Users\Admin\AppData\Local\Temp\Chemicals Genaral presentation.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1316

C:\Users\Admin\AppData\Local\Temp\Chemicals Genaral presentation.exe
"{path}"
2⤵
- UAC bypass
- Windows security bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:108

C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Admin\AppData\Local\Temp\Chemicals Genaral presentation.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:752

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs0.txt"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs1.txt"
4⤵
PID:1384

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs2.txt"
4⤵
PID:1824

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs3.txt"
4⤵
PID:1844

C:\Program Files (x86)\Internet Explorer\iexplore.exe
/stext "C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs4.txt"
4⤵
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

2

T1089

Modify Registry

4

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs2.txt

Download Submit
C:\Users\Admin\AppData\Roaming\G2G228Q5-P8H1-G1U7-U4L6-D1K007E3Y0Y8\pqzvmabjs4.txt

Download Submit
memory/108-12-0x0000000000CC0000-0x0000000000CC4000-memory.dmp

Filesize
16KB

Download
memory/108-3-0x00000000004010B8-mapping.dmp

Download
memory/108-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/108-13-0x0000000002AD0000-0x0000000002AD4000-memory.dmp

Filesize
16KB

Download
memory/752-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/752-9-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/752-8-0x0000000000401364-mapping.dmp

Download
memory/1316-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1328-29-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1328-31-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1328-30-0x000000000040C2A8-mapping.dmp

Download
memory/1384-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1384-19-0x0000000000411654-mapping.dmp

Download
memory/1384-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1508-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1508-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1508-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1508-15-0x0000000000423BC0-mapping.dmp

Download
memory/1824-22-0x0000000000442F04-mapping.dmp

Download
memory/1824-23-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1824-21-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1844-27-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1844-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1844-26-0x0000000000413750-mapping.dmp

Download
memory/1844-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads