7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674

General

Target

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
Size

4.7MB
MD5

e6bab40afa17ee4ca68100bf093b77d7
SHA1

c2399d6d9bb661f470500c7bc1c922f270a1744d
SHA256

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674
SHA512

4b6750b499f63fcb0cb40d97710dc9b0cf6861ad1ffc1750d7c815513d116dd1486a38e595af7cccb88d47f342ba099c7aa30b28582b2a947a1c9b64419d1a74
SSDEEP

98304:Z2ZeGl6O8wzfF7Nr9Qs2yx+nSOQtFrPGLec+3iS28nJcmmH5pL2NdaQv:Yf6sBB3UQDGLH+SP8nlCj2j7

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/960-58-0x0000000002A90000-0x0000000002B02000-memory.dmp	upx
behavioral1/memory/960-59-0x0000000002F50000-0x0000000002FC2000-memory.dmp	upx
behavioral1/memory/960-61-0x0000000002A90000-0x0000000002B02000-memory.dmp	upx

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/960-55-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect
behavioral1/memory/960-56-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect
behavioral1/memory/960-60-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect
behavioral1/memory/960-63-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect
behavioral1/memory/960-69-0x0000000000400000-0x0000000000E49000-memory.dmp	vmprotect

Loads dropped DLL 1 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

pid process

960 7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

pid	process
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

1520 cmd.exe

pid	process
1520	cmd.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

pid	process
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe

description	pid	process	target process
PID 960 wrote to memory of 1520	960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe
PID 960 wrote to memory of 1520	960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe
PID 960 wrote to memory of 1520	960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe
PID 960 wrote to memory of 1520	960	7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe
"C:\Users\Admin\AppData\Local\Temp\7a6f288f18b0eeb1872d86e1bda5966061f7b94dad1025dfa7ed264b4178e674.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\6d5a61.tmp.bat
2⤵
- Suspicious behavior: RenamesItself
PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6d5a61.tmp.bat
Filesize
180B

MD5
de78cfee6b529103a987a0e32ec76352

SHA1
debce661cee57e27a324a40b15988a038dcc34db

SHA256
5600f286db5731e5a7336d080b5ea5457c4f1f0b8a62bdd4b1caac2a6cb81710

SHA512
b2e772ef4e5cc9ddfaf2af2caee3bb1a89d9f1c72c9eaef2d43a8cb86434fadbc0140ac4a427147fa2ab9d99630b554af93d8ad657edc79aacfb61e835f7a5d7

Download Submit
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
Filesize
98KB

MD5
1dd2a4a0f4d21eb65db5895fca2ca489

SHA1
b0c0617f6f66b35e255ec9824cde41f382a60e80

SHA256
7a7f037bab8024a9d17fb225cc4aa04133081135ecc4be5bbb889c0fbebd7e0c

SHA512
214e7aa56e820ebec87a778293871672f7c4e92d06bdf5ba18a2fc536003b2e15ebdce65c1ae3c927a16fcfe865c1720a7262e7a700459c66b4ae563374518ae

Download Submit
memory/960-58-0x0000000002A90000-0x0000000002B02000-memory.dmp

Filesize
456KB

Download
memory/960-54-0x0000000075651000-0x0000000075653000-memory.dmp

Filesize
8KB

Download
memory/960-59-0x0000000002F50000-0x0000000002FC2000-memory.dmp

Filesize
456KB

Download
memory/960-60-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/960-61-0x0000000002A90000-0x0000000002B02000-memory.dmp

Filesize
456KB

Download
memory/960-62-0x0000000002F50000-0x0000000002FC2000-memory.dmp

Filesize
456KB

Download
memory/960-63-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/960-56-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/960-65-0x0000000010000000-0x0000000010056000-memory.dmp

Filesize
344KB

Download
memory/960-69-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/960-55-0x0000000000400000-0x0000000000E49000-memory.dmp

Filesize
10.3MB

Download
memory/1520-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads