34e44584e027f3cc20492606ea1353314566d7edda23030640b33216df4c5931

Analysis

max time kernel
163s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

042d47eb51d6a3d799a5f68fba4197a2.exe
Size

298KB
MD5

042d47eb51d6a3d799a5f68fba4197a2
SHA1

ce89cc2dcd05260481a398e956d3ff5b58023cba
SHA256

34e44584e027f3cc20492606ea1353314566d7edda23030640b33216df4c5931
SHA512

3431600313c353bfa5ecd6a2a4084f7de8d1be9792a38938b0f60fdf2199afe0825b7dcf9c3c4874acdfc54ccc894cbaf280083816f3d1838dd5735e29565501
SSDEEP

6144:CzSY0RcrnbIFMzEOjh64JDZs6z7/WKtuujadWpOAX2uBYhmbK:uKcrnbIA7dTYKsujae2uChmbK

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000002320f-24.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	042d47eb51d6a3d799a5f68fba4197a2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pp.exe	042d47eb51d6a3d799a5f68fba4197a2.exe
File opened for modification	C:\Windows\SysWOW64\pp.exe	042d47eb51d6a3d799a5f68fba4197a2.exe
File opened for modification	C:\Windows\SysWOW64\Pnkd.exe	042d47eb51d6a3d799a5f68fba4197a2.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe	042d47eb51d6a3d799a5f68fba4197a2.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe	042d47eb51d6a3d799a5f68fba4197a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Version Vector	042d47eb51d6a3d799a5f68fba4197a2.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.1188.com/?042d47eb51d6a3d799a5f68fba4197a2"	042d47eb51d6a3d799a5f68fba4197a2.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open\ = "´ò¿ªÖ÷Ò³(&H)"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open\command	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\open\command	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.1188.com/?042d47eb51d6a3d799a5f68fba4197a2"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\lnkfile	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\open	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)\ = "ÊôÐÔ(&R)"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\DefaultIcon	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\InprocServer32	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)\Command	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\InprocServer32\InprocServer32 = "Apartment"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder\Attributes = "0"	042d47eb51d6a3d799a5f68fba4197a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\ = "Internet Explorer"	042d47eb51d6a3d799a5f68fba4197a2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shellex	042d47eb51d6a3d799a5f68fba4197a2.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 936	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	91
PID 1344 wrote to memory of 936	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	91
PID 1344 wrote to memory of 936	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	91
PID 1344 wrote to memory of 4448	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	92
PID 1344 wrote to memory of 4448	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	92
PID 1344 wrote to memory of 4448	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	92
PID 1344 wrote to memory of 852	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	93
PID 1344 wrote to memory of 852	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	93
PID 1344 wrote to memory of 852	1344	042d47eb51d6a3d799a5f68fba4197a2.exe	93
PID 936 wrote to memory of 2560	936	cmd.exe	97
PID 936 wrote to memory of 2560	936	cmd.exe	97
PID 936 wrote to memory of 2560	936	cmd.exe	97
PID 936 wrote to memory of 2408	936	cmd.exe	98
PID 936 wrote to memory of 2408	936	cmd.exe	98
PID 936 wrote to memory of 2408	936	cmd.exe	98
PID 852 wrote to memory of 2280	852	cmd.exe	102
PID 852 wrote to memory of 2280	852	cmd.exe	102
PID 852 wrote to memory of 2280	852	cmd.exe	102
PID 852 wrote to memory of 412	852	cmd.exe	101
PID 852 wrote to memory of 412	852	cmd.exe	101
PID 852 wrote to memory of 412	852	cmd.exe	101
PID 4448 wrote to memory of 4544	4448	cmd.exe	100
PID 4448 wrote to memory of 4544	4448	cmd.exe	100
PID 4448 wrote to memory of 4544	4448	cmd.exe	100
PID 4448 wrote to memory of 5008	4448	cmd.exe	99
PID 4448 wrote to memory of 5008	4448	cmd.exe	99
PID 4448 wrote to memory of 5008	4448	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\042d47eb51d6a3d799a5f68fba4197a2.exe
"C:\Users\Admin\AppData\Local\Temp\042d47eb51d6a3d799a5f68fba4197a2.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun60.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun31.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\srun83.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\╞⌠╢» Internet Explorer Σ»└└╞≈.lnk" /G Everyone:R /C
    3⤵
    PID:412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe

Filesize
814KB

MD5
5e5f63cd0ca3ee94c61a2db20ce33fc9

SHA1
c90ea9645c7cc1ad7553675a7ecdf880b1fb4621

SHA256
219280ffebd3d771102fc3a7f26529e5e9161366e3a5de2f8943d81dda7756bf

SHA512
b36df698f1cbe52df754db9fcfba7e6811b6fc74f44a89378ce29356630f66a10d526402e9d133f8ab608bb614e2214945c0b732b4db3d0cad3d3665e062edcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\srun31.bat

Filesize
142B

MD5
de4d1de797a02c49f52de44ab64f85a4

SHA1
8732f32a26ca896f8dc7cf5364edfe4667e918c7

SHA256
67ffac484b1287c9ccdf3dbc220cd1964fb266311bb9055a3f0e2c5c0b030c5b

SHA512
8bf42a0abff1fa82e3a45e03e688e08f72ff730519bd87f01a71a41ba0156740f8b5be2c46bc18e62ab4de3f5e9f89dc21250314486057a00a65ba922a98ffe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\srun60.bat

Filesize
130B

MD5
0ed20e05f54d2cf22b6e0dc1dd85b595

SHA1
887a0b44d838c479ea8c7e3fe02751515d3e8e27

SHA256
9d95fb3cbd1505b75517f95146255987b005ca2a493046604da6e587db67d386

SHA512
184f8b920549232288724b459954b465d7503142667b71328eefa62ca7302966ec13832608232d8c3f2a72ab7220c48ed774b451531b308fa12d7501280f37ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\srun83.bat

Filesize
191B

MD5
542e1265467c6a4b23d7ef07aa00bb6f

SHA1
607be982972f32d1a57d609ff100d87d6a547560

SHA256
2bfc1c64ae2f40d1a5d659d1d24d51a1d1167f8ace27ef09c6056cd4089109f8

SHA512
e230b664c21962bd2b06bf9b8d1aa6b171cbddfb15e130f0425e8e2d9fc887587d8a3a18d14d8616d306d618975094f10a77a10858fa9dea8355f86a9fdfec33

Download Submit
C:\Users\Admin\Desktop\Internet Explorer.lnk

Filesize
1KB

MD5
b9c30dd5624addb5d2e35f3088a09dbd

SHA1
b1b8b8bf405549bcb4598e6ee5b5c47a41d149fa

SHA256
baf171df7be4decb566bf8ffd48648b3704ad4b2075aae1bbd83fd1d66d950b2

SHA512
df7204fcf840b585e46152188c57686a24fed5bf1f524b9729d30590993e5ef37af1ae9d2c4d0b8e1c8a82cfd5a49d565e7e7759eb5fc6662a80f898b6bb8894

Download Submit
C:\Windows\SysWOW64\Pnkd.exe

Filesize
298KB

MD5
d9132b25a7578d2adad207968b0ab16d

SHA1
75a5aa5631ae3c96cbd760b35577573397047def

SHA256
9e289bde9f99e02f0be31561ff93a538f462620c64d29cb9f208efd23d94bda6

SHA512
6453c17bb99256a3c2db8bb597cba7f00bdc0499363d075ed88df1821be6e5483df56a2fcd90082c1d1649a4953b24da8aa3bda965eed11d35dbee5ab6856baa

Download Submit
memory/1344-0-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/1344-26-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads