2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68

General

Target

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
Size

345KB
MD5

44b3c44d1d315d26311e932208b1c976
SHA1

568b085e4f77486f8d50541dfccaef245b859e5b
SHA256

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68
SHA512

0ab303109069471bf8a3738302ff7d3a12f3613e5331af65daa09c3bcdf3d3263bb3751843ee64f078184396770a45243ecbc9ab0b0fcc76f09bd48fb5a1c7b0
SSDEEP

6144:ZSvUox59653OwQ8MbEscrNMYopzSv1LuPS2a5z9ow5kvOHgnavqfFKHxmKXqp/Ws:ZSPceNdANM/18JMaMw5wOHgavEFKRVe9

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

UIoqcMjUXy.exe

pid process

4256 UIoqcMjUXy.exe

pid	process
4256	UIoqcMjUXy.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4864-134-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/4256-140-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UIoqcMjUXy.exe = "C:\\ProgramData\\UIoqcMjUXy.exe"	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Download	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

pid	process
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

description	pid	process	target process
PID 4864 wrote to memory of 4256	4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe	UIoqcMjUXy.exe
PID 4864 wrote to memory of 4256	4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe	UIoqcMjUXy.exe
PID 4864 wrote to memory of 4256	4864	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe	UIoqcMjUXy.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe

C:\Users\Admin\AppData\Local\Temp\2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe
"C:\Users\Admin\AppData\Local\Temp\2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68.exe"
1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864

C:\ProgramData\UIoqcMjUXy.exe
C:\ProgramData\UIoqcMjUXy.exe
2⤵
- Executes dropped EXE
PID:4256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\UIoqcMjUXy.exe
Filesize
345KB

MD5
44b3c44d1d315d26311e932208b1c976

SHA1
568b085e4f77486f8d50541dfccaef245b859e5b

SHA256
2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68

SHA512
0ab303109069471bf8a3738302ff7d3a12f3613e5331af65daa09c3bcdf3d3263bb3751843ee64f078184396770a45243ecbc9ab0b0fcc76f09bd48fb5a1c7b0

Download Submit
C:\ProgramData\UIoqcMjUXy.exe
Filesize
345KB

MD5
44b3c44d1d315d26311e932208b1c976

SHA1
568b085e4f77486f8d50541dfccaef245b859e5b

SHA256
2d19824897a121847e05baf8f1f35f0010d815e07ec719625dd9fc7f7859fa68

SHA512
0ab303109069471bf8a3738302ff7d3a12f3613e5331af65daa09c3bcdf3d3263bb3751843ee64f078184396770a45243ecbc9ab0b0fcc76f09bd48fb5a1c7b0

Download Submit
memory/4256-135-0x0000000000000000-mapping.dmp

Download
memory/4256-138-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4256-139-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4256-140-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4864-132-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4864-133-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4864-134-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads