5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105

General

Target

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
Size

925KB
MD5

cc35033eee401e89a46c3b8c81dd5580
SHA1

7d67214a70afea22314ec2659e49a701de58e502
SHA256

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105
SHA512

99298770d48a45a963a6ad687e1e446440112e8ae9124435a05c9051246ed1dbc877c9f716a0968d37b9a22e79ac798865af7dce3d50c022a13fdd0eb6d78050
SSDEEP

12288:Qmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaRF:LSkv/VCWkdJ0OpGmyNtjPn68REYsb

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/544-55-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-57-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-58-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-62-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-63-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-64-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-65-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/544-67-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

description	pid	process	target process
PID 2036 set thread context of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

pid	process
544	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
544	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
544	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
544	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
544	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

description	pid	process	target process
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
PID 2036 wrote to memory of 544	2036	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe	5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe

C:\Users\Admin\AppData\Local\Temp\5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
"C:\Users\Admin\AppData\Local\Temp\5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe
"C:\Users\Admin\AppData\Local\Temp\5f872b4f123f1df35cdbeab946918b3002ea3725d9f41122e345c25ab2c55105.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-54-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-55-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-57-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-58-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-59-0x00000000004E76D0-mapping.dmp

Download
memory/544-61-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/544-62-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-63-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-64-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-65-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/544-67-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads