c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe
Size

1.2MB
MD5

3d244ea7488701bf8be114b5189598fa
SHA1

f4224305b9e49669d83e27febeec4d3a98233695
SHA256

c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8
SHA512

c4cd0fbcca9b477c052c3d85b46dfa889856b69a2c30c7a7f4ae68b7ceb0b9f7019cd182850dea2cc4b0000bd8f7a7a1b97b223702a623787b93ebde2600ea2c
SSDEEP

24576:iT/OrbQykadNZcUVarLHGo1lDAtoiCK6kTVR8SavCc/SnbYqBeWTn10Qj4ce:iTKbPkDEmLm0EtoDQ8S6CuqBeGnavce

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4516-140-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-142-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-143-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-145-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-144-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-147-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-149-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-151-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-153-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-155-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-157-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-159-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-161-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-163-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-165-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-167-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-169-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-171-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-175-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-173-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-177-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-179-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-181-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-183-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-185-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4516-186-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1729329563"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f11a8d9abe1b63418f6afec5d69685980000000002000000000010660000000100002000000016d38ce8acd9d190c36886f4409e3c581fd6455512fa2d0a52853804be88b53f000000000e800000000200002000000009fc38b86e08178be32dd761efc82bff6e235806ee4ff748ed180d447aef85bd20000000a6a3b5adada5342ef6c868560860584a683e371e79ec611bdf63ff0e94c54694400000008010dc48525b1caa49f8cefde5bd5f7cc171b5706848bd6444f4ad50e68af15daeb46741e38309d4399e20ef0bef101773dfe52bf347a53453543fdefd2dc1f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999323"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1729329563"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903021751b03d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1023e07a1b03d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999323"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1803080270"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f11a8d9abe1b63418f6afec5d6968598000000000200000000001066000000010000200000002dd9ab2406a52423cdc45e0d41b9fa5aa27e2da5af9be686ac2ac2343705d52f000000000e8000000002000020000000a1dc6a9e3957ee53c84b7b4effda32ecf18130bbd247a44a6f9238ccf936a455200000003389db5a25022b939a653cddf0dd95914675e7080203632459911de3e446c0dc400000008be964cf74610e3aba017d4e7b8ce211db101451006d83c283883de5f54d873adf62c0a2452576542bd06695d7c8eb99895d1b18a4bafaf2ea77ecfd83f05298	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376399374"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{96E6BB1D-6F0E-11ED-B696-5203DB9D3E0F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999323"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4820	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4516	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe
4516	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe
4516	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe
4820	iexplore.exe
4820	iexplore.exe
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE
3676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4820	4516	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe	79
PID 4516 wrote to memory of 4820	4516	c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe	79
PID 4820 wrote to memory of 3676	4820	iexplore.exe	80
PID 4820 wrote to memory of 3676	4820	iexplore.exe	80
PID 4820 wrote to memory of 3676	4820	iexplore.exe	80

C:\Users\Admin\AppData\Local\Temp\c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe
"C:\Users\Admin\AppData\Local\Temp\c557e0f4279607b754e51d37afff4e688a912d1570c3c2411075599c982835e8.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.x5ace.com
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4820 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
3bc8595d0a469edc8b7a071a3befe724

SHA1
f7e4b53b01d31626ab7965b267fea4457d798a91

SHA256
33c4b30d18fa3eeeed676831973cf8dd8c9a9145e7edcb689efeec0647d685d4

SHA512
4969ab6d2239a94d1dfb6105d9a329588ad0e3366ab4af874e033b853adfcadf808eced3466823136221e110accd2bcd5b25b0474b11947aab510f0b92d397d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
691fad95320d1fa115732875846f84c1

SHA1
e6db4364f03418c76b235cf560e13b55770b6a0a

SHA256
47773264cfbcd5e8fb5723bf63f3ac4024f3113a2b74308c873abb21ba7f7598

SHA512
c12b8cf7cd3c801392037d992675f500902c8a1dd8a46e6d587b23dff774ef8a5ef9275c78e2641b4166c3289cbad61e8ce6b02a4da0d9ce6b21be68da9bfe90

Download Submit
memory/4516-159-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-161-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-136-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-138-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-139-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-140-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-142-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-143-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-145-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-144-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-147-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-149-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-151-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-153-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-155-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-157-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-135-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-132-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-163-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-165-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-167-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-169-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-171-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-175-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-173-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-177-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-179-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-181-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-183-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-185-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-186-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4516-187-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-134-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-133-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/4516-190-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads