eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268

Analysis

max time kernel
158s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe
Size

230KB
MD5

2c192f76425e966ae698a84130dc89f2
SHA1

6bbcb0c953c15b11f7489a6d976b20a75f64d54c
SHA256

eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268
SHA512

43b730ea0c7b0fed79230917dfd18f3418a3f749c03d1a5f3ba8cea3b4b954833984f0c60db96d17c2baa4c84e991c84a37ee1f72d864a2c48dee43568d91d8e
SSDEEP

3072:epvmvakjLm7PR5Q3k3vHjNr0eOGjIUi/cDhn0y24ywvDDjbngcQVS+1aA6:epWjkP/ZHjN9Njv7jbnZWS+

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1564	Pratea.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001231e-57.dat	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Pratea.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Pratea.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe
File created	C:\Windows\Pratea.exe	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe
File opened for modification	C:\Windows\Pratea.exe	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International	Pratea.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	Pratea.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe
1564	Pratea.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1564	800	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe	28
PID 800 wrote to memory of 1564	800	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe	28
PID 800 wrote to memory of 1564	800	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe	28
PID 800 wrote to memory of 1564	800	eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe	28

C:\Users\Admin\AppData\Local\Temp\eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe
"C:\Users\Admin\AppData\Local\Temp\eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\Pratea.exe
  C:\Windows\Pratea.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Pratea.exe

Filesize
230KB

MD5
2c192f76425e966ae698a84130dc89f2

SHA1
6bbcb0c953c15b11f7489a6d976b20a75f64d54c

SHA256
eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268

SHA512
43b730ea0c7b0fed79230917dfd18f3418a3f749c03d1a5f3ba8cea3b4b954833984f0c60db96d17c2baa4c84e991c84a37ee1f72d864a2c48dee43568d91d8e

Download Submit
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

Filesize
408B

MD5
a556d783ec560d566b0c7fe45cc96fac

SHA1
752b1a88bf4ca5fe57d3eb949f32a0fd6d17fbcc

SHA256
af5325143398d57f44f687514ef99f0c62f94e19829438f33ecadb7ab80143f8

SHA512
cebfe6d32b9257cfe02789c2ce71c8de74d96a8eb47b1cf98ed9bf9697871faac14782bf7644cf4caf4ec67b25cf60105dc7bbe7f1c35a3854637b660093e59c

Download Submit
memory/800-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/800-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/800-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/800-62-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1564-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1564-63-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download