3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90

General

Target

3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Size

199KB
MD5

4bd84f505fd2d01818f0ca64be30dfad
SHA1

0ec412a212dc61eae17861a121aad86c52fb15e8
SHA256

3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90
SHA512

01752b31ac280923118c9424ec1ce947a6a8226d729fe3b2d6041901a31485751526caf56fb792b0b019ebb95a532f743186cf333b1b9db377b5985457d6cac7
SSDEEP

3072:fi5Lxv/pN/gXHILxihWmJkhTOU08q1eM4Z10q4WvHpJUrx13PU3toWt/Jx:faLF/ptgXSiPQOz8cq4SJQ3PU7Rx

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1536-55-0x0000000000040000-0x00000000000E4000-memory.dmp	upx
behavioral1/files/0x00070000000139fe-57.dat	upx
behavioral1/memory/1536-60-0x0000000000040000-0x00000000000E4000-memory.dmp	upx
behavioral1/memory/2008-62-0x0000000000040000-0x00000000000E4000-memory.dmp	upx
behavioral1/memory/2008-63-0x0000000000040000-0x00000000000E4000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1720	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadDecisionTime = f09a88e98d0dd901	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadDecision = "0"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef\WpadDecisionReason = "1"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef\WpadDecision = "0"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadDecisionReason = "1"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0099000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\WpadNetworkName = "Network 3"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{374A4AD8-4CCF-4233-8E31-D93C7984A23E}\c2-9b-92-db-05-ef	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-9b-92-db-05-ef\WpadDecisionTime = f09a88e98d0dd901	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1536	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1720	1536	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	28
PID 1536 wrote to memory of 1720	1536	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	28
PID 1536 wrote to memory of 1720	1536	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	28
PID 1536 wrote to memory of 1720	1536	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	28

C:\Users\Admin\AppData\Local\Temp\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
"C:\Users\Admin\AppData\Local\Temp\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat
  2⤵
  - Deletes itself
  PID:1720

C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
"C:\Program Files\Canon\Quick Menu\AppInfo\Apps\\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Filesize
199KB

MD5
4bd84f505fd2d01818f0ca64be30dfad

SHA1
0ec412a212dc61eae17861a121aad86c52fb15e8

SHA256
3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90

SHA512
01752b31ac280923118c9424ec1ce947a6a8226d729fe3b2d6041901a31485751526caf56fb792b0b019ebb95a532f743186cf333b1b9db377b5985457d6cac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat

Filesize
297B

MD5
f5ebda0ab80508350055fa2c5def57f6

SHA1
9df2705a332589ae5078a7e6b71985a12d618d63

SHA256
824e0cad8261a5d5736dea5bf9863cb31acabea50a47ad44c93885729378c8bf

SHA512
b7471e60e873d77a17be64ba1bfb879065a43969b34a8c4d0a20a119d7f37482aef98104e2bbeee8df60d470c499d0ba2346716b7b92e930cc1b98183c5230bc

Download Submit
memory/1536-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1536-55-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download
memory/1536-56-0x0000000075181000-0x0000000075183000-memory.dmp

Filesize
8KB

Download
memory/1536-60-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download
memory/2008-62-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download
memory/2008-63-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing