3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d

General

Target

3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
Size

1.5MB
MD5

94f3c49130bd65537832bfcaedee9516
SHA1

044832bf4de3b6f15a16ab9c8d9c779f6a74aae5
SHA256

3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d
SHA512

13ca8cea927973bd439565f35c2bac4951c08055de956ba84c0d7eddcee79b3b704df59cbf41298f0c4c407a295502d633df91295eb3b90998bd621703c915f3
SSDEEP

24576:4Qnr6M088pIXg7Z2EoDqLiOpMdA3jdXWxGVT7zoUiV8FgknkKFZPvQ:4208QNY+LiOpMdkjdUGVT7vdFxVZPvQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-2-0x0000000000320000-0x0000000000365000-memory.dmp	upx
behavioral1/memory/2220-1-0x0000000000320000-0x0000000000365000-memory.dmp	upx
behavioral1/memory/2220-3-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-4-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-6-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-12-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-14-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-13-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-10-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-8-0x0000000000370000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/2220-16-0x0000000000320000-0x0000000000365000-memory.dmp	upx
behavioral1/memory/2220-17-0x0000000000320000-0x0000000000365000-memory.dmp	upx
behavioral1/memory/2220-18-0x0000000000320000-0x0000000000365000-memory.dmp	upx
behavioral1/memory/2220-29-0x0000000000320000-0x0000000000365000-memory.dmp	upx

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\G:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\O:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\A:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\B:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\D:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\T:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\K:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\Z:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\P:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\Q:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\V:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\E:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\L:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\R:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\U:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\Y:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\H:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\J:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\W:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\X:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\I:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\N:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\S:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
File opened (read-only)	\??\M:	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TypedURLs	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2220	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2220	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
2220	3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe

C:\Users\Admin\AppData\Local\Temp\3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe
"C:\Users\Admin\AppData\Local\Temp\3d4f08863c790f6d992d604509bd7bf73484fa35964f15615d93b1aa8bcd6b4d.exe"
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÒÎØ¸¹·¹Î´ÙÖÇ\Õº¼¼ÈÚµÀÍÑ.skr

Filesize
1.5MB

MD5
4a7174fff36a3964a6e3b6146de58ba8

SHA1
fe9d2c61f72f21fdfc8518ae09483e9cc3f1b494

SHA256
798214da2a6946cba6d3ef7896360eca0bd394e9158af20f1a66a98546cef87e

SHA512
0ee9b6efe397befc1eb81f8e7dac5ce81796bf9c3ddcbae1310ae7da0025236be4c23eab48953896fb1802932b75167e30428fec8c8a2208862adef36b299326

Download Submit
memory/2220-10-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-16-0x0000000000320000-0x0000000000365000-memory.dmp

Filesize
276KB

Download
memory/2220-3-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-4-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-6-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-12-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-14-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-13-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-15-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/2220-17-0x0000000000320000-0x0000000000365000-memory.dmp

Filesize
276KB

Download
memory/2220-1-0x0000000000320000-0x0000000000365000-memory.dmp

Filesize
276KB

Download
memory/2220-8-0x0000000000370000-0x0000000000396000-memory.dmp

Filesize
152KB

Download
memory/2220-0-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download
memory/2220-18-0x0000000000320000-0x0000000000365000-memory.dmp

Filesize
276KB

Download
memory/2220-19-0x00000000775AD000-0x0000000077636000-memory.dmp

Filesize
548KB

Download
memory/2220-20-0x0000000003520000-0x00000000036A7000-memory.dmp

Filesize
1.5MB

Download
memory/2220-21-0x0000000003520000-0x00000000035B8000-memory.dmp

Filesize
608KB

Download
memory/2220-2-0x0000000000320000-0x0000000000365000-memory.dmp

Filesize
276KB

Download
memory/2220-29-0x0000000000320000-0x0000000000365000-memory.dmp

Filesize
276KB

Download
memory/2220-30-0x0000000003520000-0x00000000036A7000-memory.dmp

Filesize
1.5MB

Download
memory/2220-31-0x0000000003520000-0x00000000035B8000-memory.dmp

Filesize
608KB

Download
memory/2220-34-0x0000000000400000-0x00000000005CF000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing