a9ca3214e1f95c7907704bcf629e51bc10b859d66ccfbeae0f99cdd91dc4b459

General

Target

c5a2f8d11b701f_JC.exe
Size

2.2MB
MD5

c5a2f8d11b701f8b31c2809a7daed58d
SHA1

29c08e09a05594b6b7a405cbd75c79685cfee3b7
SHA256

a9ca3214e1f95c7907704bcf629e51bc10b859d66ccfbeae0f99cdd91dc4b459
SHA512

518b0b14064538883596700687bb1cd1a94a4150ffc2d8d217d23055ba47e1ae857bffe998384ebc6c196b069a9159851006a476b8be02e98d3d2969788ccfc9
SSDEEP

24576:F4YKL33onzQqK2vL+Jj/sRJF9PV6GrGkg0Rr5VkMrsTYhsCMAYQWfx5VNRem9KeN:F6HozTKvJsnFVMkgGdu4ndBWNzEeBpF

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Program Files\IPADTV6.EXE	aspack_v212_v242
C:\Program Files\IPADTV6.EXE	aspack_v212_v242
C:\Program Files\IPADTV6.EXE	aspack_v212_v242
\Program Files\IPADTV6.EXE	aspack_v212_v242
C:\Program Files\IPADTV6.EXE	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

IPADTV6.EXE

pid process

1640 IPADTV6.EXE
Loads dropped DLL 2 IoCs

Processes:

c5a2f8d11b701f_JC.exe

pid process

2616 c5a2f8d11b701f_JC.exe
2616 c5a2f8d11b701f_JC.exe
Drops file in Program Files directory 1 IoCs

Processes:

c5a2f8d11b701f_JC.exe

description ioc process

File created C:\Program Files\IPADTV6.EXE c5a2f8d11b701f_JC.exe

pid	process
1640	IPADTV6.EXE

pid	process
2616	c5a2f8d11b701f_JC.exe
2616	c5a2f8d11b701f_JC.exe

description	ioc	process
File created	C:\Program Files\IPADTV6.EXE	c5a2f8d11b701f_JC.exe

Drops file in Windows directory 4 IoCs

Processes:

c5a2f8d11b701f_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	c5a2f8d11b701f_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	c5a2f8d11b701f_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	c5a2f8d11b701f_JC.exe
File created	C:\WINDOWS\Media\ActiveX.ocx	c5a2f8d11b701f_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

IPADTV6.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IPADTV6.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IPADTV6.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IPADTV6.EXE

NTFS ADS 3 IoCs

Processes:

c5a2f8d11b701f_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	c5a2f8d11b701f_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	c5a2f8d11b701f_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	c5a2f8d11b701f_JC.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c5a2f8d11b701f_JC.exe

pid process

2616 c5a2f8d11b701f_JC.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

IPADTV6.EXE

pid process

1640 IPADTV6.EXE
1640 IPADTV6.EXE

pid	process
2616	c5a2f8d11b701f_JC.exe

pid	process
1640	IPADTV6.EXE
1640	IPADTV6.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

c5a2f8d11b701f_JC.exe

description	pid	process	target process
PID 2616 wrote to memory of 1640	2616	c5a2f8d11b701f_JC.exe	IPADTV6.EXE
PID 2616 wrote to memory of 1640	2616	c5a2f8d11b701f_JC.exe	IPADTV6.EXE
PID 2616 wrote to memory of 1640	2616	c5a2f8d11b701f_JC.exe	IPADTV6.EXE
PID 2616 wrote to memory of 1640	2616	c5a2f8d11b701f_JC.exe	IPADTV6.EXE
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe
PID 2616 wrote to memory of 1680	2616	c5a2f8d11b701f_JC.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\c5a2f8d11b701f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c5a2f8d11b701f_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files\IPADTV6.EXE
  "C:\Program Files\IPADTV6.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1640
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 C:\WINDOWS\Media\ActiveX.ocx /s
  2⤵
  PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\WINDOWS\Media\ActiveX.ocx

Filesize
12B

MD5
9d6b867fd310fa0cd929c42da80caebc

SHA1
36dca3d8c4ec64a3b13b3c9e1c865aac66f4aecf

SHA256
4b57b3f5c60a9df99b52785646502d24b704fa74f9a32b94561f947ffe10c373

SHA512
037a726baeb61498bc6b577201782f5689d8903250f8ca3976c64c266bf595d39befab87dbb45bd911abc5bc64fb033913c9debbe72d1da6b8a511709bdfddcc

Download Submit
\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
memory/1640-62-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1640-105-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1640-106-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads