1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc

General

Target

1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
Size

89KB
MD5

90f7dbc5a9e4db48a4e21cf41b3c63d0
SHA1

de210c43141b6a7f32fec4c7d8c7239b10c14802
SHA256

1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc
SHA512

9ebdac6b2efb083f6390a18d8a9086b8cbb0910bcb6517bff7975e7dd2eb07ff197757fb2ad9e5229c36b0024cc51f7c3857ddc573f490261adb05985000cad1
SSDEEP

1536:Uj+Tw1UwIUnfIMOLYDCASt4OsZmmB+vErwX/JBAj8Q6L69/LrE:Uj+TgUwIZMMYxXr8vGKJBAj19M

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2012	explorer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-56.dat	upx
behavioral1/memory/1292-58-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/2012-60-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral1/memory/1292-62-0x0000000000400000-0x0000000000448000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Windows\\explorer.exe\u00a0"	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
File opened for modification	C:\Windows\explorer.exe	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
984	2012	WerFault.exe	27

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe \ = "exefile"	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe \Content Type = "application/x-msdownload"	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe \PersistentHandler	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe \PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2012	1292	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe	27
PID 1292 wrote to memory of 2012	1292	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe	27
PID 1292 wrote to memory of 2012	1292	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe	27
PID 1292 wrote to memory of 2012	1292	1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe	27
PID 2012 wrote to memory of 984	2012	explorer.exe	28
PID 2012 wrote to memory of 984	2012	explorer.exe	28
PID 2012 wrote to memory of 984	2012	explorer.exe	28
PID 2012 wrote to memory of 984	2012	explorer.exe	28

C:\Users\Admin\AppData\Local\Temp\1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe
"C:\Users\Admin\AppData\Local\Temp\1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 220
    3⤵
    - Program crash
    PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\explorer.exe

Filesize
89KB

MD5
90f7dbc5a9e4db48a4e21cf41b3c63d0

SHA1
de210c43141b6a7f32fec4c7d8c7239b10c14802

SHA256
1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc

SHA512
9ebdac6b2efb083f6390a18d8a9086b8cbb0910bcb6517bff7975e7dd2eb07ff197757fb2ad9e5229c36b0024cc51f7c3857ddc573f490261adb05985000cad1

Download Submit
C:\Windows\explorer.exe

Filesize
89KB

MD5
90f7dbc5a9e4db48a4e21cf41b3c63d0

SHA1
de210c43141b6a7f32fec4c7d8c7239b10c14802

SHA256
1516b4a7196e6f10cd61e1026a712d5493722ed4fd066cbb4253113bdbf666dc

SHA512
9ebdac6b2efb083f6390a18d8a9086b8cbb0910bcb6517bff7975e7dd2eb07ff197757fb2ad9e5229c36b0024cc51f7c3857ddc573f490261adb05985000cad1

Download Submit
memory/1292-58-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1292-59-0x0000000000450000-0x0000000000498000-memory.dmp

Filesize
288KB

Download
memory/1292-61-0x0000000000450000-0x0000000000498000-memory.dmp

Filesize
288KB

Download
memory/1292-62-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2012-60-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing