4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12

General

Target

4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Size

19KB
MD5

8d538899438aa7be685b08186d47a5e5
SHA1

af229f4d167fdf8be416f00428a9527fab18d9f1
SHA256

4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12
SHA512

b62c823979081177f85acc72359e063b9187ffea5b4be97b05f786efdc6f5e583806413fda6ab59809a56afe22df1a4701cdd911dd4ad384c1d2f78c24e95f48
SSDEEP

384:3Tu4cIqcfu8kI9KcIzwq8TSlNr4SCrvBT0MGyZzE+:Dc1cW8kIMcNq82l5yB4GJE

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2320-132-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/2320-139-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12 = "C:\\Program Files\\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe"	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\taskmgr.exe	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
File opened for modification	C:\Program Files\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
3980	taskkill.exe
2072	taskkill.exe
3996	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.j2mg.cn"	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	2072	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1804	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	83
PID 2320 wrote to memory of 1804	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	83
PID 2320 wrote to memory of 1804	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	83
PID 2320 wrote to memory of 3472	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	84
PID 2320 wrote to memory of 3472	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	84
PID 2320 wrote to memory of 3472	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	84
PID 1804 wrote to memory of 3980	1804	cmd.exe	88
PID 1804 wrote to memory of 3980	1804	cmd.exe	88
PID 1804 wrote to memory of 3980	1804	cmd.exe	88
PID 3472 wrote to memory of 3996	3472	cmd.exe	87
PID 3472 wrote to memory of 3996	3472	cmd.exe	87
PID 3472 wrote to memory of 3996	3472	cmd.exe	87
PID 2320 wrote to memory of 4984	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	96
PID 2320 wrote to memory of 4984	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	96
PID 2320 wrote to memory of 4984	2320	4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe	96
PID 4984 wrote to memory of 2072	4984	cmd.exe	98
PID 4984 wrote to memory of 2072	4984	cmd.exe	98
PID 4984 wrote to memory of 2072	4984	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe
"C:\Users\Admin\AppData\Local\Temp\4c8174f1afb863271a312d2cf3c142f9df2963376cdb166ecf0fd67b0e42bd12.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /im Explorer.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im Explorer.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /im taskmgr.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /im Explorer.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im Explorer.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2320-139-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads