106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2

General

Target

106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
Size

591KB
MD5

50917879d10f76faa3e3da29d9c521bc
SHA1

65dea88bbe79cb261ed861439fb0c68d4bc7d8bf
SHA256

106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2
SHA512

6404d4a01e8f426a3db1541a7f7a54230d57b4a495143b16b56580e9cb9605bd0f6da244d45609b7f78b4b108373494e8d04ec0ce9d72ca2a6cb0b05d6a6ce48
SSDEEP

12288:wUsvMufNWoB3pM2ouE+TA8bAZIAdQwzGag2dgdU9RNEa:wWuFWoZpCuA2LA2wzGaPdPR

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2276-132-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/2276-133-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/2276-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-137-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-138-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-139-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-143-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-141-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-145-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-147-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-149-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-151-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-153-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-155-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-157-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-159-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-161-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-163-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-165-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-167-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-169-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-171-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-173-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-175-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-177-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-179-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-180-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2276-181-0x0000000000400000-0x000000000052E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe

pid	process
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe

pid	process
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
2276	106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe

C:\Users\Admin\AppData\Local\Temp\106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe
"C:\Users\Admin\AppData\Local\Temp\106ab6b48160c6feb846b26c939bd7261d65ea10df380d8df15c1f0bb4b927c2.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-132-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2276-133-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2276-134-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-137-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-138-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-139-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-143-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-141-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-145-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-147-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-149-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-151-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-153-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-155-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-157-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-159-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-161-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-163-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-165-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-167-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-169-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-171-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-173-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-175-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-177-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-179-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-180-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2276-181-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads