a54b7365fcc3f2e534e1bf6ca38207afb05a4fd46a344e87c9534dd66a3f318d

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2023 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Photoshop_Set-Up.exe
Size

2.4MB
MD5

fd5c496532d821ac668a5dc45dac7bbf
SHA1

3d4861eb415995da4ff4b13543fe57b1b9205329
SHA256

a54b7365fcc3f2e534e1bf6ca38207afb05a4fd46a344e87c9534dd66a3f318d
SHA512

e581f9d6f19570d820e42b03fd99fc3b46a62013d7dd1180dad4f8ce8d46cfa3af71432747c82b6e17de3930169db4c686892435985bb56ca0908f730e5bbc2c
SSDEEP

49152:QazIMBCsXyJOj9Q4RIYuBAeUZ2PmGvePnmqe2fFRWpLdee/y:PzIMbykj9QnPu2DbqeFg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1160-0-0x00000000000C0000-0x0000000000869000-memory.dmp	upx
behavioral2/memory/1160-25-0x00000000000C0000-0x0000000000869000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
728	1160	WerFault.exe	80

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Photoshop_Set-Up.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Photoshop_Set-Up.exe = "11001"	Photoshop_Set-Up.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe
Token: SeIncreaseQuotaPrivilege	1160	Photoshop_Set-Up.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1160	Photoshop_Set-Up.exe
1160	Photoshop_Set-Up.exe

C:\Users\Admin\AppData\Local\Temp\Photoshop_Set-Up.exe
"C:\Users\Admin\AppData\Local\Temp\Photoshop_Set-Up.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 2256
  2⤵
  - Program crash
  PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1160 -ip 1160
1⤵
PID:4688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{5365C65B-F4A2-429C-8671-9564D4A49227}\CCDInstaller.js

Filesize
1.2MB

MD5
e0d3fdde65b5542e7cfeca5fa07c3cb1

SHA1
c02f64d9bf1e4e5fc18250621316a4f5c32ca1fe

SHA256
f84e252e3f8bcf34253be54bd72c82e98fad4b8fbcac6990238da47e11467cc2

SHA512
6106b021c448091df5a16cfa47d8626cf39942241d7c027683b3f12f4eb02d97f92a8e6184ec5e93fd0f0cbde827d2b3b312001efd946ed4711e10dd841801cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5365C65B-F4A2-429C-8671-9564D4A49227}\index.html

Filesize
426B

MD5
a28ab17b18ff254173dfeef03245efd0

SHA1
c6ce20924565644601d4e0dd0fba9dde8dea5c77

SHA256
886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

SHA512
9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

Download Submit
memory/1160-0-0x00000000000C0000-0x0000000000869000-memory.dmp

Filesize
7.7MB

Download
memory/1160-25-0x00000000000C0000-0x0000000000869000-memory.dmp

Filesize
7.7MB

Download