3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf

General

Target

3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Size

776KB
MD5

f86133741ec9ee234b932ffd8019763e
SHA1

fa23cb832c6fd87258e0b21d3320f696f39e2726
SHA256

3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf
SHA512

ea993598f78684d2951e5dcea651ec151f910ff2ef4ba3c6f55af969cedba7d15f7dd634f2c94889e2b61f947f19593ddbb124859ed6cc2cc7a02937d59ed922
SSDEEP

12288:tmYlI2y55jCY392p3N1NpzBUyqjKjc8+SQfZmaF2FOZL06k99M1UFM3Qz:tmYl5c5h3+g/jmR+vpFD0my

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-133-0x0000000000400000-0x000000000067C000-memory.dmp	upx
behavioral2/memory/4936-202-0x0000000000400000-0x000000000067C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4188	4936	WerFault.exe	79
5096	4936	WerFault.exe	79

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DOMStorage\sina.com.cn	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sina.com.cn	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sina.com.cn\NumberOfSubdomains = "1"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\weather.sina.com.cn\ = "22"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sina.com.cn\Total = "22"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "22"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DOMStorage\weather.sina.com.cn	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "59"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\weather.sina.com.cn\ = "59"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\sina.com.cn\Total = "59"	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
4936	3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe

C:\Users\Admin\AppData\Local\Temp\3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe
"C:\Users\Admin\AppData\Local\Temp\3222a0413cd776bf9f1103d86451c9e6aabbb2ffef07a85d870841245f3eacdf.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 2500
  2⤵
  - Program crash
  PID:4188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 2844
  2⤵
  - Program crash
  PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4936 -ip 4936
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4936 -ip 4936
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UDUTF4LE\weather.sina.com[1].xml

Filesize
96B

MD5
786899b33e3549d874f2f10745e00445

SHA1
02508a572f75c21b5d7d10a269bf532f7ddc88ee

SHA256
e87d884f247f74e661073a8d5bb481a8be01c4a5149a0c46caa8764c8d61aac5

SHA512
b26d400099c2edc0d202a89e04af42bb1df972116921b3d8ddf9f8a7d6252e96a562953ca6e2c4db506d6c5d36b4a7836af2f4d198d49044be8700e340b7053a

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
51B

MD5
2fe6a9ac8d1b8aa4868ecb32e5967664

SHA1
e014dc4278458812fac60ba5cea88a1647a0bca8

SHA256
f9b9c509d895420f3e54aa226a4eea13bc4f7275860228e837bb8e954c3db88a

SHA512
8513eb6e149241fa9434785994a20973ca1d1c049d33c0b4c78ede6b5518e3a1efaf14f55d4ade8847a30067c2cd4a1a657638d7aa4f2cb36ae35b33c595379d

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
51B

MD5
7f3caf47dde94a9684497dfe2aaad46d

SHA1
3ad5bc979213d4f95a5585d73f9786f3e9730242

SHA256
afcaa0eb594a76bcae5ef45151156d71ff070c198f372f09c3cacc4caffc1d21

SHA512
a5a40534a9ca46ae6c9bc5dda1574f6166cce8228ecb88802f91c1105bbde2c7546edf492deff4d3a3836adb5584a2e2f51accdcdd5eea476db3c87ba3d64e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
84B

MD5
ed87ed2d66dbbb49f9510dccbefb8e87

SHA1
a839b0e28830da2fa1119d6027a1d837c2218566

SHA256
cc29c6cac1d821b475723c0f2e625c9b414ceeea49f8c669c380000e73773846

SHA512
15d61774597e9a28250bfbcade0fc207019c133284481f44c954203bdbfc918a5fde2e9780be956da1242a64b63257851de75538a2c544461bbad31a839cf902

Download Submit
memory/4936-133-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/4936-202-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing