f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a

General

Target

f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe
Size

667KB
MD5

43262d983d3bdaa44a7df0e91f589820
SHA1

4f6a803fa05baa31e80ad618c56378c90931c978
SHA256

f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a
SHA512

bb9af59152fa54ec1f915489873ee35d084ec1745a3e3d1d831140fa15a33a4ad004d72f5a2eeafc8003143a939c488757480ca3e89cc73f5a823831a296c85b
SSDEEP

12288:PvppvF/vS00mTbFw9TjMLmGOnLtrDuyjwMdD85XUZqs:PvLvhvSLmTbFwjMS1tfqMiXUZqs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1176-55-0x0000000001D60000-0x0000000001EA7000-memory.dmp	upx
behavioral1/memory/1176-59-0x0000000001D60000-0x0000000001EA7000-memory.dmp	upx
behavioral1/memory/1176-58-0x0000000001D60000-0x0000000001EA7000-memory.dmp	upx
behavioral1/memory/1176-62-0x0000000001D60000-0x0000000001EA7000-memory.dmp	upx
behavioral1/memory/1176-63-0x0000000001D60000-0x0000000001EA7000-memory.dmp	upx
behavioral1/memory/1176-64-0x0000000001D60000-0x0000000001EA7000-memory.dmp	upx
behavioral1/memory/668-67-0x0000000001D00000-0x0000000001E47000-memory.dmp	upx
behavioral1/memory/668-71-0x0000000001D00000-0x0000000001E47000-memory.dmp	upx
behavioral1/memory/668-70-0x0000000001D00000-0x0000000001E47000-memory.dmp	upx
behavioral1/memory/668-72-0x0000000001D00000-0x0000000001E47000-memory.dmp	upx
behavioral1/memory/668-74-0x0000000001D00000-0x0000000001E47000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe
1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe
1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 668	1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe	28
PID 1176 wrote to memory of 668	1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe	28
PID 1176 wrote to memory of 668	1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe	28
PID 1176 wrote to memory of 668	1176	f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe	28

C:\Users\Admin\AppData\Local\Temp\f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe
"C:\Users\Admin\AppData\Local\Temp\f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe
  "C:\Users\Admin\AppData\Local\Temp\f720ef10b3f1ae4b9e3cbeb76650c9f1ce3961fa653a8951c184f4ae69561e8a.exe" /_ShowProgress
  2⤵
  PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-74-0x0000000001D00000-0x0000000001E47000-memory.dmp

Filesize
1.3MB

Download
memory/668-72-0x0000000001D00000-0x0000000001E47000-memory.dmp

Filesize
1.3MB

Download
memory/668-70-0x0000000001D00000-0x0000000001E47000-memory.dmp

Filesize
1.3MB

Download
memory/668-71-0x0000000001D00000-0x0000000001E47000-memory.dmp

Filesize
1.3MB

Download
memory/668-67-0x0000000001D00000-0x0000000001E47000-memory.dmp

Filesize
1.3MB

Download
memory/1176-58-0x0000000001D60000-0x0000000001EA7000-memory.dmp

Filesize
1.3MB

Download
memory/1176-63-0x0000000001D60000-0x0000000001EA7000-memory.dmp

Filesize
1.3MB

Download
memory/1176-64-0x0000000001D60000-0x0000000001EA7000-memory.dmp

Filesize
1.3MB

Download
memory/1176-62-0x0000000001D60000-0x0000000001EA7000-memory.dmp

Filesize
1.3MB

Download
memory/1176-61-0x0000000000250000-0x00000000002F7000-memory.dmp

Filesize
668KB

Download
memory/1176-60-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1176-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1176-59-0x0000000001D60000-0x0000000001EA7000-memory.dmp

Filesize
1.3MB

Download
memory/1176-55-0x0000000001D60000-0x0000000001EA7000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing