895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a

General

Target

895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe
Size

218KB
MD5

32a0615410754e84b06f127f1601ea9d
SHA1

7188ae6ff8ebae133ecb91b68cc746d80d7c053e
SHA256

895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a
SHA512

b2d7cc6837af595fa3d3c3f970427ece1fe13d0e62c7faf70b8e934d6f32af42627bd379d6b9531bec3a1e13a1bb3fee48ac17095637214a369331052b30e185
SSDEEP

3072:N8DZDcdQRRwZJ+nqaTDZlBATQGB/OquFZYgdqI/gFgcg7XuPCGZe30RsApIh1ZE1:5QwwqaxAsc/gr5dP1jGZGtApgy

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

algs.exe

pid process

536 algs.exe

pid	process
536	algs.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1112-54-0x0000000000400000-0x000000000047D000-memory.dmp	upx
C:\algs.exe	upx
behavioral1/memory/536-60-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1112-61-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/memory/1112-63-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Naver Agents = "C:\\Users\\Admin\\AppData\\Local\\Temp\\895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe"	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Naver Agents = "C:\\Users\\Admin\\AppData\\Local\\Temp\\895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe"	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002146f23b324c2042975db12a3aa60e64000000000200000000001066000000010000200000009a91afcd75406727eec33fce20bcc67b91685272f8890e58ec02042b265de623000000000e80000000020000200000000d2035427d03bb7b875fe3cf573255d96f897b082e3a5bbc4ae4b91b51f3187620000000d5809078a5c71cf787022258ef8334a1d33576207456defeb299de013ed85bc340000000d53236a9c5fa6d57c362e77c4bd3f8e4270c6557b74f248b9a3cbb589b7342f7ab2b61405d767e053fdb7b7aa6b3b9fea14f0c753dfd92716407549d54de9e79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002146f23b324c2042975db12a3aa60e6400000000020000000000106600000001000020000000f502248861771364b44e8858c5f7e741da2eca424fa08c41d4589153ead318c5000000000e8000000002000020000000ff1c44020d53d26ea7e586757d4f8f25701afccc7f79360f55307ada4cda860d90000000d0838c83358c457154171edd9ab5a2eabaad65ce3b57f0d3e7c119c24fa6031a4fe2dba83d1338028f405c3d4a144014946ad04c1dbc8439031c8cc25ec4b136d2f55b9a7721c64650970887d0cbdc7828367fd09263a2e29727c6682892dbc049c4d63ba59c806efe39d9fa95029ce1e2cbbf37116f89f0b577838500042e20385cb3e0b20d5de18c59aeef2693914b40000000d2965a8adc36eceb78d4812c9d35f3dfefdda02b0498f4bb05d6f8186bc4431c82d485f40649202b4f0558f03b375e123dcc2da50451df4ad3a95b8798d896dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376333703"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608a4f9d8202d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B00DF881-6E75-11ED-9F1A-42A98B637845} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

1924 iexplore.exe
1924 iexplore.exe
1924 iexplore.exe
1924 iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1924	iexplore.exe
1924	iexplore.exe
828	IEXPLORE.EXE
828	IEXPLORE.EXE
1924	iexplore.exe
1924	iexplore.exe
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1924	iexplore.exe
1924	iexplore.exe
396	IEXPLORE.EXE
396	IEXPLORE.EXE
1924	iexplore.exe
1924	iexplore.exe
332	IEXPLORE.EXE
332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exeiexplore.exe

description	pid	process	target process
PID 1112 wrote to memory of 536	1112	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe	algs.exe
PID 1112 wrote to memory of 536	1112	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe	algs.exe
PID 1112 wrote to memory of 536	1112	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe	algs.exe
PID 1112 wrote to memory of 536	1112	895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe	algs.exe
PID 1924 wrote to memory of 828	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 828	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 828	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 828	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 1644	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 1644	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 1644	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 1644	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 396	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 396	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 396	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 396	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 332	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 332	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 332	1924	iexplore.exe	IEXPLORE.EXE
PID 1924 wrote to memory of 332	1924	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe
"C:\Users\Admin\AppData\Local\Temp\895ef7d9bf32231532bf814d5585ff77eb2a02f8150589405102653890ed1e6a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1112

C:\algs.exe
"C:\algs.exe"
2⤵
- Executes dropped EXE
PID:536

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:828

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:472069 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:603143 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:396

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:668685 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1IM6B2C2.txt
Filesize
608B

MD5
1f9e05b35fce0a68dc1fbb60fbbc1d18

SHA1
911a0fc6407496372bb43ee2c7fac311eaa449f1

SHA256
875cd9d516555997481cb3f2bb49e1bfff1a34f6333d704530b24cd941263c86

SHA512
70543f779146cecae114e7fb122ca424bbeaac36997fab744cd40fbfc3ee903ac655fa8327ac493711ceff818deb39fc683b7542347a586634b7e34044ede73b

Download Submit
C:\algs.exe
Filesize
46KB

MD5
4b69db9d7c245b1e2b6dcb8a764cd1f2

SHA1
b6f506ea538d59f0ef9721ddbdd963dc3c6f5122

SHA256
db45111dc7ac77fcd23788a9dcdd1c38e1de9180cc35e432ef2120ba1ad35b5c

SHA512
5c1abcf59be354224843a727bd6c3bf4dae1d3a3914fdd241b74e7ca692dd94e09fb7ad6859b6b0484e9c296a76090b7e0859088927787b67b885d1b3720e0ea

Download Submit
memory/536-56-0x0000000000000000-mapping.dmp

Download
memory/536-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1112-54-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1112-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1112-59-0x0000000003010000-0x0000000003036000-memory.dmp

Filesize
152KB

Download
memory/1112-61-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1112-62-0x0000000003010000-0x0000000003036000-memory.dmp

Filesize
152KB

Download
memory/1112-63-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads