4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450

General

Target

4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Size

332KB
MD5

e25b345ce0eafa924fc3113c8e57c13c
SHA1

28cf299f71c9f645588fbade8b6fe6cbb333b32d
SHA256

4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450
SHA512

81c8f07d44ca3dca91fd92c59b8130d370d01a1a11d90f8a2cde41d323ecd5b64a755f440ea9a220cbc8384a3194773145f6262359e7d085f6e482bd03e4a31a
SSDEEP

6144:TejAK3P4QL49yuzSy9D8WpaDmSEkBDK+AUN7i8w8JH91scKH6CU:KjAK3Loy+9DFpWZAM48JsHS

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1680-132-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/1680-133-0x0000000000400000-0x00000000004AE000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1680-133-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}\URL = "http://www.go2000.cn/p/?q={searchTerms}"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{402128F8-5DD7-4039-B4BE-80E4366186AF}"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}\DisplayName = "网页搜索"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\SearchScopes	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "1"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}\URL = "http://www.go2000.cn/p/?q={searchTerms}"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{402128F8-5DD7-4039-B4BE-80E4366186AF}"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}\DisplayName = "网页搜索"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{402128F8-5DD7-4039-B4BE-80E4366186AF}\Codepage = "65001"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.you2000.net/"	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe

C:\Users\Admin\AppData\Local\Temp\4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe
"C:\Users\Admin\AppData\Local\Temp\4a756967ad561feee6a55ac4a86aaacebfb220062300bce041c2ad84548bb450.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-132-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1680-133-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads