856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf

General

Target

856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
Size

25KB
MD5

32342c4f6b6c4b804f06b35cf7616dc1
SHA1

aaa2f9463fc8811c7fc3b70e9f0c306fc6b9a65f
SHA256

856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf
SHA512

d56f7dc4bdbad2c013aafd071efe5a61e5bd206039dd291431e3c023f2cf5c5d2d21e019c6896a1fe22ee0af5f315183ddd4beed88207c8926b53ff6603ed59b
SSDEEP

384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUrpdtO0xPtVx:SCIqdH/k1ZVcT194jp41dM0PVx

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1396-55-0x0000000000800000-0x000000000080D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe"	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\Winamp 5.0 (en) Crack.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\WinRAR.v.3.2.and.key.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\index.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\Winamp 5.0 (en).com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\Harry Potter.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\WinRAR.v.3.2.and.key.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ICQ 4 Lite.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\index.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\Harry Potter.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\Harry Potter.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\Winamp 5.0 (en).exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\WinRAR.v.3.2.and.key.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\Winamp 5.0 (en).ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\Kazaa Lite.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\WinRAR.v.3.2.and.key.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\Winamp 5.0 (en).com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\Winamp 5.0 (en).com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\index.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\Kazaa Lite.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\Winamp 5.0 (en) Crack.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\WinRAR.v.3.2.and.key.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\ICQ 4 Lite.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\Kazaa Lite.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\Harry Potter.ShareReactor.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ICQ 4 Lite.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\Winamp 5.0 (en) Crack.com	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\lsass.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
File created	C:\Windows\lsass.exe	856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe

C:\Users\Admin\AppData\Local\Temp\856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe
"C:\Users\Admin\AppData\Local\Temp\856e7f4049895822a1b05f26ef4a0b850ec9a6782bddc81a654432a4c28ad3cf.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1396-55-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing