78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3

General

Target

78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe
Size

1024KB
MD5

26728565d42d1f2e3b8d605fddf67f06
SHA1

2e3fc8de1516e2417e4a0a88bd4ea9b768861220
SHA256

78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3
SHA512

76d1b29abdf529204a7336ee1236b276897dcc920aa70183447b9cd1fcc52e08b8b32935f396700489e5285efd1a43867f07e4a5ed7305d306e56718c02773b2
SSDEEP

12288:tUOzqZGV2BDbcxaLM/P2YkND8rTEocr858KwWMyOfztTf+p+WuR5nWFpPoS9YQ6t:8RbcxaLM/cNdoDOIHO5b+gKbzYByTVe

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-91-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-97-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-99-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-101-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-95-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-93-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1632-102-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1632	78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe
1632	78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe
1632	78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe
1632	78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe
1632	78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe

C:\Users\Admin\AppData\Local\Temp\78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe
"C:\Users\Admin\AppData\Local\Temp\78edde85457820d7eb169e326b9d5e1a8cff7846f0dc1c91a0ea68f5150e21d3.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1632-55-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1632-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-91-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-97-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-99-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-101-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-95-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-93-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-102-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1632-111-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing