c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7

Analysis

max time kernel
144s
max time network
193s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
Size

828KB
MD5

a90d9b49ab27d76efeccbdf566539f0c
SHA1

976197a9031b5c16a7a28c3c76eafcca5b7def7f
SHA256

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7
SHA512

cf787527b35639023a863668e08c8c3ee094cce7fd4b97c6e887b417adc0eb582dc68a680908873d448b016d12123040e31857d405c73c10f7988efd9f09b944
SSDEEP

24576:XlH5JF9HN+6UdNTkJWMRXRo7dgFYFot5WGWk2DrHitjnXmfp:XlZJrHN+6gKBRS6FYCtCDjwn2fp

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-103-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-101-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-104-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376173634"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE947861-6D00-11ED-A6F1-EED7317926BC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1236	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
1236	iexplore.exe
1236	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	30
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	30
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	30
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	30
PID 1236 wrote to memory of 1728	1236	iexplore.exe	31
PID 1236 wrote to memory of 1728	1236	iexplore.exe	31
PID 1236 wrote to memory of 1728	1236	iexplore.exe	31
PID 1236 wrote to memory of 1728	1236	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
"C:\Users\Admin\AppData\Local\Temp\c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.zblwg.com/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QWOP6IJL.txt

Filesize
601B

MD5
38441cb4a15eea3d1b2f2092c283a6f7

SHA1
25852b4bd59a36ca45719722f4a1d06c70efcd5e

SHA256
468de8660de3fd8e6d4b995767340920c77feedf839619d567d58a7ad25e170b

SHA512
f81d6ed26bdd1f95b7f447fa1b9916f2cf6a058d4b970fa491ab26f3dd543dcc838e16f11679f909042bf3131ba7a101434d1f5a4a8200f43b213dcbd68e2d46

Download Submit
memory/2036-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-55-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-57-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-103-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-101-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-104-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-105-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-106-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download