c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5

Analysis

max time kernel
323s
max time network
449s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
Size

253KB
MD5

016f9a46239b28ba44a013a0647d1ca1
SHA1

ab7ed64b7a74afae667a9a9cf2952dac79e51fff
SHA256

c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5
SHA512

e90344d581439f30d38476436b20561bd5848b8816398ce24e96d8576509bdd96f0d5af0a35e1ad522dd18a7c91843ca2f33a3188f3613d4cec225a02658ad6a
SSDEEP

6144:3BNQ+hYsnGOJFop2ZvZjB8O2n3ex+2LQKHKE:3BNQex+2L

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3640-132-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Download	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3640	c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe

C:\Users\Admin\AppData\Local\Temp\c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe
"C:\Users\Admin\AppData\Local\Temp\c2ace5c1c4c2b3235f8160df4c0e07cb2601137ae14c3a38fe3960c9abb0bae5.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3640-132-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download