d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4

General

Target

d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Size

1.0MB
MD5

60e68502f934972a0da76ec100ae56ea
SHA1

137105d289ac7ca8e068062e2d8ea3465cf92994
SHA256

d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4
SHA512

ecaed8bc90adccd1e024ac62943af1b57e42fbe7d8ab8a538c6aa7c27658b8016149a2c411d4c28f8a121cd29e472e6fa437d882ff450b0fc984e6c3ede42539
SSDEEP

24576:yLjizH8o4GYsJfpMggVoHyWe/L0pz8bsm+Ov:yaJYyCVoJAApwwqv

Score

8^/10

evasion upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4800-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-5-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4800-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\Policies\System	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4800	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
4800	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
4800	d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe

C:\Users\Admin\AppData\Local\Temp\d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe
"C:\Users\Admin\AppData\Local\Temp\d42294970bf105ab9216d341221d3878620522fd6ef44741979c47ef46c7d7b4.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4800-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-5-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4800-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads