3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
Size

14.8MB
MD5

9e98d38b9f47a0d6625f6a46e6066e0b
SHA1

b3c2e87055eda2a691858de09fa303836951f01a
SHA256

3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c
SHA512

80bf34167cf1e86dd2a471ed94498f1d5bbbc842a04bb068155ff6e895ec79afe02cd36604662d1445a9df96876f27785f51f91f4a0c251cd29aefb83a34fe26
SSDEEP

393216:jRjwqhrJNckvGTOhSthbG8w3tk0ByearyiKtqUk:Fj/nNcknhSjq8wTB8pKtqUk

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2520	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2264-5-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2264-9-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/files/0x0006000000016cae-33.dat	upx
behavioral1/files/0x0006000000016cae-36.dat	upx
behavioral1/memory/2264-41-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-42-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/files/0x0006000000016cae-44.dat	upx
behavioral1/memory/2520-45-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-49-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-70-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-73-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-74-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-75-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-220-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-222-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-223-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-225-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-380-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx
behavioral1/memory/2520-409-0x0000000000400000-0x0000000000CC2000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\U:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\Y:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\Z:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\W:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\A:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\B:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\G:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\H:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\I:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\K:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\L:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\M:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\N:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\P:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\T:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\X:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\E:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\J:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\Q:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\R:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\S:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
File opened (read-only)	\??\V:	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2520	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2520	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2520	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
2520	254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2520	2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe	29
PID 2264 wrote to memory of 2520	2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe	29
PID 2264 wrote to memory of 2520	2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe	29
PID 2264 wrote to memory of 2520	2264	3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe	29

C:\Users\Admin\AppData\Local\Temp\3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
"C:\Users\Admin\AppData\Local\Temp\3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
  C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c68bc854dac0cb269c8349d0feb67fe.txt

Filesize
20B

MD5
282f3f56f62a7d39e6ccef3ee5c298fe

SHA1
dc50d3e6a77bcf76e03bed8481df795acd870a1d

SHA256
a601945d665a1afd6a0299b87e2561a5e42d1fa1babde98e22db5476f85bedd5

SHA512
bfb202400cec7d23e0b9d9f5cb097a094dd60ca4f0fe1ca5558871afd956e1bb7a70c6845b653393bab69ff138bc1dda9532f57725659f49f00ecf54a70ad72e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c36b0372402b064eee8c67ef58f9f7b.ini

Filesize
420B

MD5
5b382182a7d7498534bd4aa64f64f70e

SHA1
903258d8da4b158c9b509d87a8d234d157913e52

SHA256
10909dd6fa3f70fb0781786b970afae840cd897ce5dbabaf4c9390e046ae17df

SHA512
59ed5e78352b0af37ba9a28276f51bbe5488845a0400531b7c1f41dc776a9a8673cc5a3aae3ac74e0dfca5c575e56c0dbc7d6f6f3fb427148a0304d8d582ad2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c36b0372402b064eee8c67ef58f9f7b.ini

Filesize
10KB

MD5
1ecf5699d5e0eac34a48c7b190919550

SHA1
d817f89611447f04ac0f7ad6114a028dcf5fdf06

SHA256
7d0e3aee550ac04642be8425489e39c413c400c1969cf6b2b2bfea9966be4cf3

SHA512
69937f8200c1eb90f381fa1e03b088796d641d750c392d6508beda7a99eca932d1b9af2a5624b3f446b8d1c728b40463dc67b14eb5b3753922dcc245b22c39ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.dat

Filesize
102B

MD5
14390df5d09643d45683964d2283694b

SHA1
1abf3479a6b661ec24233d0d63bdbb08bb59f717

SHA256
7d9fcedff932077cbe42d304ea1e6048d7c757020acf844297e7600bdc9ac178

SHA512
e001e15dc1c27e21397ec779de64957a8792c1eb94794ddd716a5c1b35ffd6beeb7c0bb7758d8ea1c1f5d8d9459d965603d34dc35189aac6c71cc142e785d536

Download Submit
C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Filesize
14.8MB

MD5
9e98d38b9f47a0d6625f6a46e6066e0b

SHA1
b3c2e87055eda2a691858de09fa303836951f01a

SHA256
3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c

SHA512
80bf34167cf1e86dd2a471ed94498f1d5bbbc842a04bb068155ff6e895ec79afe02cd36604662d1445a9df96876f27785f51f91f4a0c251cd29aefb83a34fe26

Download Submit
C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Filesize
14.8MB

MD5
9e98d38b9f47a0d6625f6a46e6066e0b

SHA1
b3c2e87055eda2a691858de09fa303836951f01a

SHA256
3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c

SHA512
80bf34167cf1e86dd2a471ed94498f1d5bbbc842a04bb068155ff6e895ec79afe02cd36604662d1445a9df96876f27785f51f91f4a0c251cd29aefb83a34fe26

Download Submit
C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\Data\log.dat

Filesize
613B

MD5
75c997aae46147761cd2e2d7678abe72

SHA1
f72c8b3c337bf25c144b44bda0eb8f7bffa4a250

SHA256
7dc0a6d7101a0b4d50f8f0d11d3df6b5af6a529ff480158875680b4981f0f768

SHA512
51b812f7129792b70c8051ee3cc0486d935cdc00bd8baf83a02650e78a638b21215c91ee8f67b2b489ead6f36355c4951faeff211793ca12dc77bb0ad0aa9403

Download Submit
C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\Data\log.dat

Filesize
846B

MD5
9ce2ac0eb3e1102ceb107071ac51dc56

SHA1
e2b60e8bf8b1440e8390b714913d32bda56dcac8

SHA256
ef6d2ae077a4b86de65b73aa89e25902d8f9f667d23010e1881b76e063b32cb7

SHA512
5139f38c3a26afa4f5476610a55908ea98725e73ef1401bd313b8f3590aead0ab82d5ba322306b6f3aa0bad1b80b31f18771734419ab402c981b2090ef9384d0

Download Submit
C:\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\Data\log.dat

Filesize
233B

MD5
90d9629685ca3ab87d060442e8a1620a

SHA1
554a797d5c2b153506f37616f9f94567c024f41c

SHA256
8413e9ae961cb4b9ff4ae2302b192b2d6ff4e6de657f6fa2b30cec4714335872

SHA512
419eb9e3c88262651f36abf5a80ad790259f79b416924513e27c92227d96055101f60bace84c10b28328ba69d1d52f160e143fe30f2456e4113b58b5dcb73b7d

Download Submit
\Í¨Ìì´óµÀ¡¾Î¢¶Ë¡¿\254093562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c.exe

Filesize
14.8MB

MD5
9e98d38b9f47a0d6625f6a46e6066e0b

SHA1
b3c2e87055eda2a691858de09fa303836951f01a

SHA256
3562c5bc5506a0312409fdb7d737f462106a395e715cbd99d7f5c2c21c93693c

SHA512
80bf34167cf1e86dd2a471ed94498f1d5bbbc842a04bb068155ff6e895ec79afe02cd36604662d1445a9df96876f27785f51f91f4a0c251cd29aefb83a34fe26

Download Submit
memory/2264-41-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2264-8-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/2264-4-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/2264-40-0x000000000D9F0000-0x000000000E2B2000-memory.dmp

Filesize
8.8MB

Download
memory/2264-5-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2264-7-0x0000000003740000-0x0000000003741000-memory.dmp

Filesize
4KB

Download
memory/2264-6-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/2264-9-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2264-0-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-222-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-73-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-74-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-75-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-77-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2520-49-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-42-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-51-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/2520-220-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-221-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2520-223-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-47-0x0000000003820000-0x0000000003821000-memory.dmp

Filesize
4KB

Download
memory/2520-70-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-225-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-275-0x00000000055A0000-0x00000000055C0000-memory.dmp

Filesize
128KB

Download
memory/2520-354-0x00000000055A0000-0x00000000055C0000-memory.dmp

Filesize
128KB

Download
memory/2520-380-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-45-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download
memory/2520-43-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2520-409-0x0000000000400000-0x0000000000CC2000-memory.dmp

Filesize
8.8MB

Download