5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71

General

Target

5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
Size

1.2MB
MD5

d15c44dfcf8c645bfd58de688e2ef89f
SHA1

c7211e7e547a58ee5bd0de718639608653c1815a
SHA256

5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71
SHA512

43a000dd5bbb4c1380abe8eab0fb2414191da069b98387bd0eab5e38ce43d4c79fc142939b4c873eb77c34aee08d04a93a99f668cbaa7baf869db717cc1e9c4d
SSDEEP

24576:oTncNfx9X01rFQgq2cNFrGRe3tYTuP2ZNH+LxWqHa5bBMx/np6mmERSM:oTcNwBVvcNV8wtaZeLxWZ2x/nr

Score

8^/10

upx vmprotect

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3436-137-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-140-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-139-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-141-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-142-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-144-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-146-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-148-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-150-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-152-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-154-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-156-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-158-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-160-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-162-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-164-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-166-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-168-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-170-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-172-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-174-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-176-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-178-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-180-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-182-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/3436-183-0x0000000010000000-0x000000001003E000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/3436-132-0x0000000000400000-0x00000000006FF000-memory.dmp	vmprotect
behavioral2/memory/3436-135-0x0000000000400000-0x00000000006FF000-memory.dmp	vmprotect
behavioral2/memory/3436-136-0x0000000000400000-0x00000000006FF000-memory.dmp	vmprotect
behavioral2/memory/3436-184-0x0000000000400000-0x00000000006FF000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe

pid	process
3436	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
3436	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
3436	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
3436	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
3436	5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe

C:\Users\Admin\AppData\Local\Temp\5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe
"C:\Users\Admin\AppData\Local\Temp\5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3436-132-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/3436-135-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/3436-136-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/3436-137-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-140-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-139-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-141-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-142-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-144-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-146-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-148-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-150-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-152-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-154-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-156-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-158-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-160-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-162-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-164-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-166-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-168-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-170-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-172-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-174-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-176-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-178-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-180-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-182-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-183-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3436-184-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads