6af64d57c2a5dfd7ccc96cd5c874b775f94ae870225410efbd70ba75b59b8fb5

General

Target

2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Size

1.7MB
MD5

c975226800a73ce2b35695e0e26cf1c7
SHA1

338cb61c11955c84b62fc1f6d5f266ac8e7d8705
SHA256

2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545
SHA512

6ad4ef2af53fca60fd962da113feeed4ee7b4697b8806b69acff83b94096e7d705de37135de69e41ecb0c518d943c6dd343950658c18dace7a330b3af0b45dbf
SSDEEP

24576:Gp8e0LjcyswMUlaLKQIg1fS3YzdPHpz/KkGrkGD5gehgYlGaP36nhL+6uGiwYTVW:Gp8nE6e3Qk2kGRhgYlGI3y9MGSTbg

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2324-132-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2324-133-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral1/memory/2324-134-0x0000000000400000-0x00000000004CD000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe

Modifies registry class 20 IoCs

Processes:

2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe

pid	process
2324	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
2324	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe

C:\Users\Admin\AppData\Local\Temp\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
"C:\Users\Admin\AppData\Local\Temp\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-132-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2324-133-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2324-134-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ = "ExternalNSHandler"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ = "eBookNSHandler"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.eBookNSHandler	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.ExternalNSHandler\ = "ExternalNSHandler"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID\ = "2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.ExternalNSHandler"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.eBookNSHandler\ = "eBookNSHandler"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID\ = "2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.eBookNSHandler"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.ExternalNSHandler\Clsid	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.ExternalNSHandler\Clsid\ = "{D173E10A-001D-4318-9822-8C97A8418482}"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.eBookNSHandler\Clsid	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.ExternalNSHandler	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.eBookNSHandler\Clsid\ = "{9C453F21-396D-11D5-9734-70E252C10127}"	2fd415e5f87962cf5a7f744e2dcbe54154e67702087353e6fd4f4ed06c63b545.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads