3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf

General

Target

3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
Size

170KB
MD5

3573241e85df852e1ac4e97b75578136
SHA1

29490a0768445e2aa9ae681ed06b1bf592e5d4ce
SHA256

3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf
SHA512

aff2123bc3d3dd23f07b9c734d71891c4d122dcaefe0355ff47b9f3d9513d33bf61c80a956ea01da6eed9b7c045ad806c789a8189891bb2fde3857c1336a80eb
SSDEEP

3072:Ax99CSJFjWsh8XcuzshXbsQixSIxG6XlzC3z8j:i9lC420I1pxH1zC3z8j

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1728	msa.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/900-55-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral1/memory/900-60-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral1/memory/1728-61-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral1/memory/900-62-0x0000000000400000-0x0000000000480000-memory.dmp	upx
behavioral1/memory/1728-63-0x0000000000400000-0x0000000000480000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	msa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\LEO0WTUNO7 = "C:\\Windows\\msa.exe"	msa.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
File created	C:\Windows\msa.exe	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
File opened for modification	C:\Windows\msa.exe	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1728	WerFault.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International	msa.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
900	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe
1728	msa.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
900	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
1728	msa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1728	900	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe	27
PID 900 wrote to memory of 1728	900	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe	27
PID 900 wrote to memory of 1728	900	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe	27
PID 900 wrote to memory of 1728	900	3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe	27
PID 1728 wrote to memory of 2044	1728	msa.exe	28
PID 1728 wrote to memory of 2044	1728	msa.exe	28
PID 1728 wrote to memory of 2044	1728	msa.exe	28
PID 1728 wrote to memory of 2044	1728	msa.exe	28

C:\Users\Admin\AppData\Local\Temp\3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe
"C:\Users\Admin\AppData\Local\Temp\3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\msa.exe
  C:\Windows\msa.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 320
    3⤵
    - Program crash
    PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Filesize
408B

MD5
29a663f914f49acbdfeaf306b3560586

SHA1
d08ab6fab3d28949309c3eb195b9e391b7f3d064

SHA256
d82bb4a19836f988b36d71d7c78dca625cbe5df9fa25076803a1aeb23540f8cd

SHA512
8f92e52a078bc0ee2942d20c434bd13444404c2d097600e6a0805ae9becdb86d76f62f23d084482058f560ae9feee6da3caa6989230c4f919ed50dd90917ac45

Download Submit
C:\Windows\msa.exe

Filesize
170KB

MD5
3573241e85df852e1ac4e97b75578136

SHA1
29490a0768445e2aa9ae681ed06b1bf592e5d4ce

SHA256
3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf

SHA512
aff2123bc3d3dd23f07b9c734d71891c4d122dcaefe0355ff47b9f3d9513d33bf61c80a956ea01da6eed9b7c045ad806c789a8189891bb2fde3857c1336a80eb

Download Submit
C:\Windows\msa.exe

Filesize
170KB

MD5
3573241e85df852e1ac4e97b75578136

SHA1
29490a0768445e2aa9ae681ed06b1bf592e5d4ce

SHA256
3c103b2fe4b0e95ecdc691c43696d6c506603d57eda0646c2f150500f9b884cf

SHA512
aff2123bc3d3dd23f07b9c734d71891c4d122dcaefe0355ff47b9f3d9513d33bf61c80a956ea01da6eed9b7c045ad806c789a8189891bb2fde3857c1336a80eb

Download Submit
memory/900-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/900-60-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/900-62-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1728-61-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1728-63-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads