3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90

General

Target

3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Size

199KB
MD5

4bd84f505fd2d01818f0ca64be30dfad
SHA1

0ec412a212dc61eae17861a121aad86c52fb15e8
SHA256

3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90
SHA512

01752b31ac280923118c9424ec1ce947a6a8226d729fe3b2d6041901a31485751526caf56fb792b0b019ebb95a532f743186cf333b1b9db377b5985457d6cac7
SSDEEP

3072:fi5Lxv/pN/gXHILxihWmJkhTOU08q1eM4Z10q4WvHpJUrx13PU3toWt/Jx:faLF/ptgXSiPQOz8cq4SJQ3PU7Rx

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
844	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4468-132-0x0000000000040000-0x00000000000E4000-memory.dmp	upx
behavioral2/files/0x0006000000022e07-133.dat	upx
behavioral2/files/0x0006000000022e07-134.dat	upx
behavioral2/memory/4468-136-0x0000000000040000-0x00000000000E4000-memory.dmp	upx
behavioral2/memory/844-138-0x0000000000040000-0x00000000000E4000-memory.dmp	upx
behavioral2/memory/844-139-0x0000000000040000-0x00000000000E4000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
File opened for modification	C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4468	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4872	4468	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	81
PID 4468 wrote to memory of 4872	4468	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	81
PID 4468 wrote to memory of 4872	4468	3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe	81

C:\Users\Admin\AppData\Local\Temp\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
"C:\Users\Admin\AppData\Local\Temp\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat
  2⤵
  PID:4872

C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe
"C:\Program Files\Canon\Quick Menu\AppInfo\Apps\\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Filesize
199KB

MD5
4bd84f505fd2d01818f0ca64be30dfad

SHA1
0ec412a212dc61eae17861a121aad86c52fb15e8

SHA256
3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90

SHA512
01752b31ac280923118c9424ec1ce947a6a8226d729fe3b2d6041901a31485751526caf56fb792b0b019ebb95a532f743186cf333b1b9db377b5985457d6cac7

Download Submit
C:\Program Files\Canon\Quick Menu\AppInfo\Apps\3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90.exe

Filesize
199KB

MD5
4bd84f505fd2d01818f0ca64be30dfad

SHA1
0ec412a212dc61eae17861a121aad86c52fb15e8

SHA256
3a61dedec882da5a8906b6e70d5f274b380ef4f33cd04d25ebf6cc727e50ce90

SHA512
01752b31ac280923118c9424ec1ce947a6a8226d729fe3b2d6041901a31485751526caf56fb792b0b019ebb95a532f743186cf333b1b9db377b5985457d6cac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat

Filesize
297B

MD5
f5ebda0ab80508350055fa2c5def57f6

SHA1
9df2705a332589ae5078a7e6b71985a12d618d63

SHA256
824e0cad8261a5d5736dea5bf9863cb31acabea50a47ad44c93885729378c8bf

SHA512
b7471e60e873d77a17be64ba1bfb879065a43969b34a8c4d0a20a119d7f37482aef98104e2bbeee8df60d470c499d0ba2346716b7b92e930cc1b98183c5230bc

Download Submit
memory/844-138-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download
memory/844-139-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download
memory/4468-132-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download
memory/4468-136-0x0000000000040000-0x00000000000E4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing