ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403

Analysis

max time kernel
204s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe
Size

980KB
MD5

536779c8a33b1c62b492ab2c20c3fea2
SHA1

4b3fca77ad48c37f42b2611470aa45027d2cdeeb
SHA256

ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403
SHA512

a4d58a62e9aeb2cb1a23e4cc9f5198fee6957e3165bdee27f8db8f4de7f8a02775a298f6a7c991537a0b53eef476d9bbf8efb7a7cea57344c98525ecb04f46a6
SSDEEP

24576:+EKXSgN9JFWk6jJYLr2QkFJB+tdU/vZZab7OyV2XM3S6Eh:vKXS4NmjJYmQ8L+bUnLw7Xf0

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4928-132-0x0000000000400000-0x0000000000AD5000-memory.dmp	upx
behavioral2/memory/4928-133-0x0000000000400000-0x0000000000AD5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe = "C:\\Users\\Admin\\AppData\\ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe"	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TypedURLs	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4928	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4928	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe
4928	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe
4928	ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe

C:\Users\Admin\AppData\Local\Temp\ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe
"C:\Users\Admin\AppData\Local\Temp\ace7f7bda4826ff2cf1d31c04bc79709df2e0d30520ecac2ed078fda6bdfa403.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-132-0x0000000000400000-0x0000000000AD5000-memory.dmp

Filesize
6.8MB

Download
memory/4928-133-0x0000000000400000-0x0000000000AD5000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads