8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4

General

Target

8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Size

10.3MB
MD5

1c0264a36226d14e5f48e0224b5c97e6
SHA1

4a3756a9f55335840dd837929310959dd4344805
SHA256

8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4
SHA512

c3173d2c12afc74fccffb290d8bbc0a4bc75b09e88ace075a310542ba7c57c2315c8a0ece315f08236e3e81929eddc58f9eabf05dc5b0a6dd9ad67fbad2ddb6d
SSDEEP

98304:lZWM8fpgNyBwjZA+GKJVsqlZnBqc34UamU2e6Q1qUutTsL3ZS+yZJBAUZLELQz:uR2Gz9oJ4Uah2eHutTsL3ZS/JVCQz

Score

9^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00030000000006d5-132.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00030000000006d5-132.dat	upx
behavioral2/memory/532-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\jedata.dll	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\xui.ptlogin2.qq.com	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "44"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xui.ptlogin2.qq.com\ = "44"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com\NumberOfSubdomains = "2"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\qq.com	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com\NumberOfSubdomains = "1"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\qq.com\Total = "44"	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
532	8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe

C:\Users\Admin\AppData\Local\Temp\8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe
"C:\Users\Admin\AppData\Local\Temp\8e5e385f928be074d9b4e149ceaadd68de5fde89a8c57bcabc194e8ff2f930f4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\jedata.dll

Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
memory/532-133-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads