8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29

General

Target

8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
Size

15KB
MD5

51f232c828f863c084a6cfc59be4a186
SHA1

547021f097ff109b3e310b288db52b381f11b09e
SHA256

8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29
SHA512

1f56369e15fe282e0f578e33da9f780acb6f149bb307c9c091d8e59bd8942592762045556c58371acd845bb941288f4e36a1bbcd4b8ac9bf05d0df69251fa5ec
SSDEEP

384:oxzk6fGbnJlfU3T44Lgiqis9QlcffyqGeE:WZ+bfU3JyisKl4qR

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1456-57-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1380-59-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1456-60-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1380	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
1380	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1380	1456	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe	27
PID 1456 wrote to memory of 1380	1456	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe	27
PID 1456 wrote to memory of 1380	1456	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe	27
PID 1456 wrote to memory of 1380	1456	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe	27
PID 1456 wrote to memory of 1244	1456	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe	7
PID 1456 wrote to memory of 1244	1456	8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
  "C:\Users\Admin\AppData\Local\Temp\8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe
    "C:\Users\Admin\AppData\Local\Temp\8aa21148bca7ad0bfa854530565bee09010b77ed6350a0708a44f8d4983c5f29.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-55-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1380-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1456-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1456-58-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/1456-60-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing