42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1

Analysis

max time kernel
105s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
Size

123KB
MD5

a30dbf724ce568b19a8c8ea8dbb8c086
SHA1

c6e26604f5eb0bb030bc1c75fcb4ff287aacc2e9
SHA256

42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1
SHA512

55f06e25cc074e8dbd39ceb50617b89b4afe42d50365de41cd46e8581e91b5f0aea4372e0bd9b3466f1a5eba60a2f51b6bd4aa1f75ec6904e1fdc25669399138
SSDEEP

3072:tLQuZUsS7a/G3CYVZ64GsbhFnhE0tRuX22CYJX+MHHVSCqKW:/UNvdVQ4GsbhI0KG23VrHVS6

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4092-132-0x0000000000400000-0x000000000077E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Udqmqg = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Udqmqg.exe"	mspaint.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\F:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\D:	mspaint.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2429346039"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993626"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2433565152"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2433565152"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BC2C81C1-58CD-11ED-A0EE-EAB2B6EB986A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993626"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993626"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2429346039"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993626"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373952591"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2768	mspaint.exe
2768	mspaint.exe
1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1424	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
Token: SeDebugPrivilege	4032	svchost.exe
Token: SeDebugPrivilege	2768	mspaint.exe
Token: SeDebugPrivilege	3496	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1424	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2768	mspaint.exe
2768	mspaint.exe
2768	mspaint.exe
2768	mspaint.exe
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
3496	IEXPLORE.EXE
3496	IEXPLORE.EXE
3496	IEXPLORE.EXE
3496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4032	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 4092 wrote to memory of 4032	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 4092 wrote to memory of 4032	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 4092 wrote to memory of 4032	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 4092 wrote to memory of 4032	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 4092 wrote to memory of 4032	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4092 wrote to memory of 1592	4092	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	84
PID 4032 wrote to memory of 2768	4032	svchost.exe	85
PID 4032 wrote to memory of 2768	4032	svchost.exe	85
PID 4032 wrote to memory of 2768	4032	svchost.exe	85
PID 1592 wrote to memory of 3708	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	89
PID 1592 wrote to memory of 3708	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	89
PID 1592 wrote to memory of 3708	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	89
PID 3708 wrote to memory of 1424	3708	iexplore.exe	90
PID 3708 wrote to memory of 1424	3708	iexplore.exe	90
PID 1424 wrote to memory of 3496	1424	IEXPLORE.EXE	91
PID 1424 wrote to memory of 3496	1424	IEXPLORE.EXE	91
PID 1424 wrote to memory of 3496	1424	IEXPLORE.EXE	91
PID 1592 wrote to memory of 4032	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 1592 wrote to memory of 4032	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	83
PID 1592 wrote to memory of 2768	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	85
PID 1592 wrote to memory of 2768	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	85
PID 1592 wrote to memory of 3496	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	91
PID 1592 wrote to memory of 3496	1592	42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe	91

C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
"C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe"
    3⤵
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2768
- C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
  "C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5ddb1febcd291eb59d3d67d24a05bfd0

SHA1
fe957affe27cb991f332e7f5c86d3a15359bd3b9

SHA256
ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb

SHA512
62d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
09a79e7852027463760a2ff4a80abe62

SHA1
587d7c9e3a24f7cefcda1976cae637c0d663a755

SHA256
83f396d15f3157820a1af6f003faeb0b2a0f949c95bcd80bb8287d3aed055c35

SHA512
0a87ce0b29457dd895ff589fe7357f8aad8e69baf96aeb561c189090d52c5e0cd5e0eb448daaa604726b1c59c16f6b244d6b0b5e1ce5bb0731a09170ebc7f03c

Download Submit
memory/1592-145-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1592-137-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1592-139-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1592-143-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2768-148-0x0000000003BB0000-0x0000000003BFE000-memory.dmp

Filesize
312KB

Download
memory/2768-147-0x0000000003BB0000-0x0000000003BFE000-memory.dmp

Filesize
312KB

Download
memory/4032-146-0x00000000034B0000-0x00000000034FE000-memory.dmp

Filesize
312KB

Download
memory/4032-144-0x0000000001220000-0x0000000001241000-memory.dmp

Filesize
132KB

Download
memory/4092-132-0x0000000000400000-0x000000000077E000-memory.dmp

Filesize
3.5MB

Download
memory/4092-142-0x00000000009D0000-0x00000000009E4000-memory.dmp

Filesize
80KB

Download
memory/4092-141-0x0000000000400000-0x000000000077E000-memory.dmp

Filesize
3.5MB

Download
memory/4092-133-0x0000000000400000-0x000000000077E000-memory.dmp

Filesize
3.5MB

Download