a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88

General

Target

a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
Size

853KB
MD5

6a8e6b872ccb683aaf31b19bd2151b56
SHA1

22fa0fc7b33047041c4947b06af29fffbb3d9e6a
SHA256

a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88
SHA512

7cd065d465caebfb9c0877e13cce89ac0383ccc2b74f0052737890a5a9fd1eaf33840def251364bd43d72a741a5835960906bcd98ab17dc24847933ed5273e31
SSDEEP

6144:0uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLPHkwix1hKZ5xl4g6:f6Wq4aaE6KwyF5L0Y2D1PqLYx1ha3l4X

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/888-55-0x0000000000400000-0x00000000005D0000-memory.dmp	upx
behavioral1/memory/888-58-0x0000000000400000-0x00000000005D0000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\mixta = "\"C:\\Users\\Admin\\AppData\\Roaming\\a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe\""	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/888-55-0x0000000000400000-0x00000000005D0000-memory.dmp	autoit_exe
behavioral1/memory/888-58-0x0000000000400000-0x00000000005D0000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
800	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1316	888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe	27
PID 888 wrote to memory of 1316	888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe	27
PID 888 wrote to memory of 1316	888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe	27
PID 888 wrote to memory of 1316	888	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe	27
PID 1316 wrote to memory of 800	1316	cmd.exe	29
PID 1316 wrote to memory of 800	1316	cmd.exe	29
PID 1316 wrote to memory of 800	1316	cmd.exe	29
PID 1316 wrote to memory of 800	1316	cmd.exe	29

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe

C:\Users\Admin\AppData\Local\Temp\a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe
"C:\Users\Admin\AppData\Local\Temp\a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v mixta /t REG_SZ /d """C:\Users\Admin\AppData\Roaming\a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe"""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v mixta /t REG_SZ /d """C:\Users\Admin\AppData\Roaming\a17646989a98441e7af835c62a148cfd1c3936a5dfc79cdd76f340e1b42b1c88.exe"""
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-57-0x0000000000000000-mapping.dmp

Download
memory/888-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/888-55-0x0000000000400000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/888-58-0x0000000000400000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/1316-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads