1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

max time kernel
156s
max time network
158s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
22-11-2023 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Size

669KB
MD5

ead18f3a909685922d7213714ea9a183
SHA1

1270bd7fd62acc00447b30f066bb23f4745869bf
SHA256

5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18
SHA512

6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91
SSDEEP

6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2508	icacls.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral21/memory/2792-0-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral21/files/0x0005000000019433-22.dat	upx
behavioral21/memory/2792-23-0x0000000003770000-0x0000000003819000-memory.dmp	upx
behavioral21/memory/1984-49-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral21/memory/2924-80-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\00029eaf-d209-4443-aef9-934c9cf6d72b\\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe\" --AutoStart"	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	api.2ip.ua
20	api.2ip.ua
26	api.2ip.ua
3	api.2ip.ua
4	api.2ip.ua
9	api.2ip.ua

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
1984	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
1984	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2452	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2452	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2924	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
2924	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2508	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	30
PID 2792 wrote to memory of 2508	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	30
PID 2792 wrote to memory of 2508	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	30
PID 2792 wrote to memory of 2508	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	30
PID 2792 wrote to memory of 2220	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	32
PID 2792 wrote to memory of 2220	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	32
PID 2792 wrote to memory of 2220	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	32
PID 2792 wrote to memory of 2220	2792	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	32
PID 2220 wrote to memory of 1984	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	36
PID 2220 wrote to memory of 1984	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	36
PID 2220 wrote to memory of 1984	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	36
PID 2220 wrote to memory of 1984	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	36
PID 2220 wrote to memory of 2452	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	37
PID 2220 wrote to memory of 2452	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	37
PID 2220 wrote to memory of 2452	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	37
PID 2220 wrote to memory of 2452	2220	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	37
PID 1984 wrote to memory of 2924	1984	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	38
PID 1984 wrote to memory of 2924	1984	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	38
PID 1984 wrote to memory of 2924	1984	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	38
PID 1984 wrote to memory of 2924	1984	5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	38

C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
"C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\00029eaf-d209-4443-aef9-934c9cf6d72b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
  "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1984 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2924
- - C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2220 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
e8115cd4deb7c7f08d5b40eea4c336c6

SHA1
55dc5c576eaa87bd87380f5ff11ded0bc434bfcf

SHA256
792cb4f801fd293addb64d6686077ef8b034cda21dfee3110f23a995c9dedf19

SHA512
0a3e98e2628e27263e0ec3b9370642468ca62cc03023c5a5776a776b99388b5bc266fe509f42d82855740548a8e2b13eba68f6c0c51ad4edb804c79555b1877d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4364e4eebe2a561352d62354e59fbc33

SHA1
a049236d2a4058fa94111caa49bbaa26a18888de

SHA256
c27d82a569ede8372b34dbf3d011af9039f832d6df59cae167bfc27d12bd77e1

SHA512
519d8a03e2b4191698a4a79813cb9e3194d26a8ebb8a0ea1aad41b43dc8cbcc78d0a5f6e44b918c2ead5a413c6ce05fa2edf99dbdd77c49988366a4f4d5c2b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0d594ca3b0b1dbfd96d3d220fc6bb70

SHA1
7807da2732078922712f9e5b5041260fcaae4304

SHA256
f7eb86b00d0328bbaaf3750179f3d2059e63f7616197047d7ce924d502c3ed38

SHA512
64cdaa49ef91363d082aa207b2e9d3004227c264ea1da4c70f8f48a389dffa154da251d211a7cff6f8d20afbd41ecde23687ae02340f8af573a0ab12d9ae186d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
878a5a576cafde6e1ac60ad9687a77f8

SHA1
0ea5bbce4ef69c9b11588ccd5ee7c56a5af02ca9

SHA256
8030344c0d87dba43cd71fbfb78123401c8cf5c736bf81083d90e5fe04131ec2

SHA512
a6419a9a27a03f590c6470a291d6ccdcdba63f1e3bcdcade0b52236cb6f3d233e9a7f315508eba8051e23313fa8a692bb90217526d4e205531808606746e8eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
18f803474e54d45de2135756b2d39ca8

SHA1
81794bf2dee28e0a66b999df0429de1ea53b1766

SHA256
f7de381e0e1695cc08a8717bbe634f5e95fd4c42c9d99754b628c20c68160222

SHA512
33f6570d6cc20f3677094ab5f4931472eb125196546113e950c328a1e700c56b9fab581abe045ab566cc6483c6cb5f2f7541b1ee8e3a181fcc54331592a3350a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
18f803474e54d45de2135756b2d39ca8

SHA1
81794bf2dee28e0a66b999df0429de1ea53b1766

SHA256
f7de381e0e1695cc08a8717bbe634f5e95fd4c42c9d99754b628c20c68160222

SHA512
33f6570d6cc20f3677094ab5f4931472eb125196546113e950c328a1e700c56b9fab581abe045ab566cc6483c6cb5f2f7541b1ee8e3a181fcc54331592a3350a

Download Submit
C:\Users\Admin\AppData\Local\00029eaf-d209-4443-aef9-934c9cf6d72b\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Filesize
669KB

MD5
ead18f3a909685922d7213714ea9a183

SHA1
1270bd7fd62acc00447b30f066bb23f4745869bf

SHA256
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

SHA512
6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17E4.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97AE.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/1984-86-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1984-49-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1984-100-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1984-101-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/1984-52-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1984-51-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/2220-48-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2220-29-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2220-83-0x0000000002560000-0x0000000002609000-memory.dmp

Filesize
676KB

Download
memory/2220-46-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2220-45-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2220-44-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2220-82-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2220-47-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/2220-28-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/2452-55-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2452-102-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2452-104-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2452-54-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2792-25-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2792-26-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2792-24-0x0000000003780000-0x0000000003829000-memory.dmp

Filesize
676KB

Download
memory/2792-23-0x0000000003770000-0x0000000003819000-memory.dmp

Filesize
676KB

Download
memory/2792-3-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2792-2-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2792-0-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2924-84-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2924-85-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2924-98-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2924-99-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2924-80-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download