10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc

General

Target

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Size

296KB
MD5

01125c2410986a64ddaf8eadb0e96c99
SHA1

772a3ac54322a7c46586e1b2196ecc0d07459741
SHA256

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc
SHA512

12b33bdce59ea077e42d1614eee8a466336c1c8d3399e5a7669246ee5cc8ff0fc3c5b1cfb9330bdf55d3f0c6e489859417bb98c81c461f169b64c61c331abb22
SSDEEP

6144:POpslFlqNhdBCkWYxuukP1pjSKSNVkq/MVJbX:PwsleTBd47GLRMTbX

Score

8^/10

persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\java\\update.exe"	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\java\\update.exe"	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0WCA3W4R-C5W1-CL62-2BR4-7L55F2WJI15W}	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0WCA3W4R-C5W1-CL62-2BR4-7L55F2WJI15W}\StubPath = "C:\\java\\update.exe Restart"	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3012-133-0x0000000010410000-0x0000000010475000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\java\\update.exe"	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java = "C:\\java\\update.exe"	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

pid process

3012 10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

pid	process
3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe

description	pid	process	target process
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE
PID 3012 wrote to memory of 700	3012	10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe
"C:\Users\Admin\AppData\Local\Temp\10c2ed696e80a6fef2deb49d6986d5da4b753de5cb765e66c09e4377078f76bc.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-133-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/5116-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads