c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7

General

Target

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
Size

828KB
MD5

a90d9b49ab27d76efeccbdf566539f0c
SHA1

976197a9031b5c16a7a28c3c76eafcca5b7def7f
SHA256

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7
SHA512

cf787527b35639023a863668e08c8c3ee094cce7fd4b97c6e887b417adc0eb582dc68a680908873d448b016d12123040e31857d405c73c10f7988efd9f09b944
SSDEEP

24576:XlH5JF9HN+6UdNTkJWMRXRo7dgFYFot5WGWk2DrHitjnXmfp:XlZJrHN+6gKBRS6FYCtCDjwn2fp

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2036-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-103-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-101-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2036-104-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376173634"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE947861-6D00-11ED-A6F1-EED7317926BC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe

pid	process
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe

description pid process

Token: SeDebugPrivilege 2036 c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1236 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe

pid	process
1236	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exeiexplore.exeIEXPLORE.EXE

pid	process
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
1236	iexplore.exe
1236	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exeiexplore.exe

description	pid	process	target process
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	iexplore.exe
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	iexplore.exe
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	iexplore.exe
PID 2036 wrote to memory of 1236	2036	c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe	iexplore.exe
PID 1236 wrote to memory of 1728	1236	iexplore.exe	IEXPLORE.EXE
PID 1236 wrote to memory of 1728	1236	iexplore.exe	IEXPLORE.EXE
PID 1236 wrote to memory of 1728	1236	iexplore.exe	IEXPLORE.EXE
PID 1236 wrote to memory of 1728	1236	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe
"C:\Users\Admin\AppData\Local\Temp\c0f40f593a163e5c82f079646bdc4f95b291c39318b6504a74c9d09490eebee7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.zblwg.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QWOP6IJL.txt
Filesize
601B

MD5
38441cb4a15eea3d1b2f2092c283a6f7

SHA1
25852b4bd59a36ca45719722f4a1d06c70efcd5e

SHA256
468de8660de3fd8e6d4b995767340920c77feedf839619d567d58a7ad25e170b

SHA512
f81d6ed26bdd1f95b7f447fa1b9916f2cf6a058d4b970fa491ab26f3dd543dcc838e16f11679f909042bf3131ba7a101434d1f5a4a8200f43b213dcbd68e2d46

Download Submit
memory/2036-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-55-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-57-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-103-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-101-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-104-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2036-105-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-106-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2036-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads