125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14-01-2023 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
Size

1.6MB
MD5

cdc539ce4873fcf79e1509e133460ffa
SHA1

9b73d331f70a0031266da0062a5ccc825fd2ebe1
SHA256

125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8
SHA512

548a009a82c7697eb58ffe22e378af3acf475ec422e3aaaaae0a0dcfc758927b1c5f127c570afd33d72863552013ffef211d72dd735c0e95fd8fc376002a25f6
SSDEEP

24576:QG6Z4LUoHbpHVIplfRZBYMCN6psVwZEBIBgeKOA3GBT5juh00tdkILbSB+c9fw2:jUrGVIplfnSk8GvjpyLeBhB

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1816-55-0x0000000000400000-0x0000000000962000-memory.dmp	upx
behavioral1/memory/1816-58-0x0000000000400000-0x0000000000962000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
1816	125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe

C:\Users\Admin\AppData\Local\Temp\125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe
"C:\Users\Admin\AppData\Local\Temp\125cdd2bba71140a4d5a8358a2944c03cef84a76a96cb266edb0411ecfb1e9d8.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000000400000-0x0000000000962000-memory.dmp

Filesize
5.4MB

Download
memory/1816-58-0x0000000000400000-0x0000000000962000-memory.dmp

Filesize
5.4MB

Download