4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12

General

Target

4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Size

19KB
MD5

8d538899438aa7be685b08186d47a5e5
SHA1

af229f4d167fdf8be416f00428a9527fab18d9f1
SHA256

4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12
SHA512

b62c823979081177f85acc72359e063b9187ffea5b4be97b05f786efdc6f5e583806413fda6ab59809a56afe22df1a4701cdd911dd4ad384c1d2f78c24e95f48
SSDEEP

384:3Tu4cIqcfu8kI9KcIzwq8TSlNr4SCrvBT0MGyZzE+:Dc1cW8kIMcNq82l5yB4GJE

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1932-57-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1932-62-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12 = "C:\\Program Files\\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe"	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\taskmgr.exe	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
File opened for modification	C:\Program Files\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
676	taskkill.exe
936	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.j2mg.cn"	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	676	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1252	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	30
PID 1932 wrote to memory of 1252	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	30
PID 1932 wrote to memory of 1252	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	30
PID 1932 wrote to memory of 1252	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	30
PID 1932 wrote to memory of 584	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	31
PID 1932 wrote to memory of 584	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	31
PID 1932 wrote to memory of 584	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	31
PID 1932 wrote to memory of 584	1932	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	31
PID 1252 wrote to memory of 676	1252	cmd.exe	34
PID 1252 wrote to memory of 676	1252	cmd.exe	34
PID 1252 wrote to memory of 676	1252	cmd.exe	34
PID 1252 wrote to memory of 676	1252	cmd.exe	34
PID 584 wrote to memory of 936	584	cmd.exe	35
PID 584 wrote to memory of 936	584	cmd.exe	35
PID 584 wrote to memory of 936	584	cmd.exe	35
PID 584 wrote to memory of 936	584	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
"C:\Users\Admin\AppData\Local\Temp\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /im Explorer.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im Explorer.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /im taskmgr.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1932-57-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1932-62-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads