5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142

Analysis

max time kernel
152s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe
Size

818KB
MD5

ee53aebccbb766f12de4907951152921
SHA1

9cd7f7ad7bf28680db84eac6f6d829dd30f997e6
SHA256

5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142
SHA512

828ed6645be03c337587af1883d78f35e3ad7cb23af546ad7a8af62b336abf0b76c05cc33f780f32b121bc1ac1625c5494fb41b2abbc1227f13a26f974d070d3
SSDEEP

12288:pCq9PMFMMOZyyY3gH27L1aXbYwt2MJFu/EUgXyWJYJKw7S3L0V4/ok7Srp5zp:pC+PMz4Ul074VPKIKw+W4tWl5zp

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4516-132-0x0000000000400000-0x00000000007A6000-memory.dmp	upx
behavioral2/memory/4516-134-0x0000000000400000-0x00000000007A6000-memory.dmp	upx
behavioral2/memory/4516-135-0x0000000000400000-0x00000000007A6000-memory.dmp	upx
behavioral2/memory/4516-136-0x0000000000400000-0x00000000007A6000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe"	5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main	5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DefaultCompressedRecord = d580f97f73ea9a12df200acaa925c832ab5fb4fe2417a19a0e6fa3ca1fae670b6c4959345af328bd86b7b15a3a36c84b7391d7f165f224a2e09e1806bda995a864552a0812864cc1c0d6a8e3656199040414f1a6b3677f91e14a3024bb791ac46fe79dc31fba2a	5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RecordModifiedMax = "DGWHDwdKxGTC/3OrgnlfZyX4XEOyv/Z3UmsIVEWNLaJt3Riwtrh+kfXjJYjoKYdiwg=="	5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FlagsModifiedValid = 0000000000000000	5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe

C:\Users\Admin\AppData\Local\Temp\5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe
"C:\Users\Admin\AppData\Local\Temp\5a1f85170b60cf4309001b1cf3ebb6789785e51073e8a5c21b2bcfa58b258142.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:4516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4516-132-0x0000000000400000-0x00000000007A6000-memory.dmp

Filesize
3.6MB

Download
memory/4516-134-0x0000000000400000-0x00000000007A6000-memory.dmp

Filesize
3.6MB

Download
memory/4516-135-0x0000000000400000-0x00000000007A6000-memory.dmp

Filesize
3.6MB

Download
memory/4516-136-0x0000000000400000-0x00000000007A6000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads