73f03b369e9df60c2dc97baefcdc4ba920da3a2126c873a4654e1a83510d3b87

General

Target

tmp.exe
Size

652KB
MD5

31549917cdc6e3f9d40a48ea5998493f
SHA1

c0f7e826645b1ba2ba1fed866992beb9de7a31df
SHA256

73f03b369e9df60c2dc97baefcdc4ba920da3a2126c873a4654e1a83510d3b87
SHA512

709737c36ef4fe96e99dcac210854a760cbbcff7af428620a0a83f16a5db09af4dbe2b52ccd4cff08fe0d5d4e544ddd9474c7c45005938a32705960c3581dad1
SSDEEP

12288:pC6wyk1nvfBP0FQoOd/566f81qjbravk7o3xLWAB8TMfo+aqwFtaif8dHOqPNspj:pC6wp1vfhboOb66Uyavk8hdo+g8BOONu

Score

7^/10

bootkit persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5020-133-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/5020-329-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/5020-333-0x0000000000400000-0x00000000005AC000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tmp.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "70"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "97"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "133"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.msn.com\ = "133"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\NumberOfSubdomains = "1"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "70"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "70"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "97"	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "97"	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\msn.com	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.msn.com	tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\msn.com\Total = "133"	tmp.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5020	tmp.exe
Token: SeIncBasePriorityPrivilege	5020	tmp.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe
5020	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\xuid[1].gif

Filesize
37B

MD5
3eacd0132310ea44cad756b378a3bc07

SHA1
e2216a7e9b73f5cb0279351c78ce61c33475cea7

SHA256
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

SHA512
bd9ab35dde3a5242b04c159187732e13b0a6da50ddcff7015dfb78cdd68743e191eaf5cddedd49bef7d2d5a642c217272a40e5ba603fe24ca676a53f8c417c5d

Download Submit
memory/5020-133-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/5020-135-0x000000006F8B0000-0x000000006F8C0000-memory.dmp

Filesize
64KB

Download
memory/5020-329-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/5020-333-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing