210b0015ef10b78b3cb1d4e657ffb7dd24f7a829186f50c25e936d61090a702f

General

Target

05e406bcb04ba7fc8cb5a6644c43c806.exe
Size

2.8MB
MD5

05e406bcb04ba7fc8cb5a6644c43c806
SHA1

21db28ebb41a018a4c07cdf11181cc4c9bb77275
SHA256

210b0015ef10b78b3cb1d4e657ffb7dd24f7a829186f50c25e936d61090a702f
SHA512

8cd2f231ae743b48657f285d64b4a41d6f4785ad10943c2deaff8635eda9c91f6223f59f74d0ef0028299dbb4968a0a1cfa3ad911bfb2f705eefa54fb9c59923
SSDEEP

49152:qZN/xKHA5FHAybBI5n+4FJj1a5LteyGtajAhIG57HL0toOVXFbqHpy:wUHADHAyIj1a5ZLGtakHwtoOJFbqJy

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2908-0-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-14-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-15-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-16-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-19-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-20-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-21-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-23-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-24-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-25-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-26-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-27-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-28-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-29-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-30-0x0000000000400000-0x00000000009AE000-memory.dmp	upx
behavioral1/memory/2908-31-0x0000000000400000-0x00000000009AE000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	05e406bcb04ba7fc8cb5a6644c43c806.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}	05e406bcb04ba7fc8cb5a6644c43c806.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\LocalServer32	05e406bcb04ba7fc8cb5a6644c43c806.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\05e406bcb04ba7fc8cb5a6644c43c806.DynamicNS	05e406bcb04ba7fc8cb5a6644c43c806.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\05e406bcb04ba7fc8cb5a6644c43c806.DynamicNS\ = "DynamicNS"	05e406bcb04ba7fc8cb5a6644c43c806.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\05e406bcb04ba7fc8cb5a6644c43c806.DynamicNS\Clsid\ = "{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}"	05e406bcb04ba7fc8cb5a6644c43c806.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ProgID	05e406bcb04ba7fc8cb5a6644c43c806.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ProgID\ = "05e406bcb04ba7fc8cb5a6644c43c806.DynamicNS"	05e406bcb04ba7fc8cb5a6644c43c806.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ = "DynamicNS"	05e406bcb04ba7fc8cb5a6644c43c806.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e406bcb04ba7fc8cb5a6644c43c806.exe"	05e406bcb04ba7fc8cb5a6644c43c806.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\05e406bcb04ba7fc8cb5a6644c43c806.DynamicNS\Clsid	05e406bcb04ba7fc8cb5a6644c43c806.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2908	05e406bcb04ba7fc8cb5a6644c43c806.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2908	05e406bcb04ba7fc8cb5a6644c43c806.exe
2908	05e406bcb04ba7fc8cb5a6644c43c806.exe
2908	05e406bcb04ba7fc8cb5a6644c43c806.exe
2908	05e406bcb04ba7fc8cb5a6644c43c806.exe

C:\Users\Admin\AppData\Local\Temp\05e406bcb04ba7fc8cb5a6644c43c806.exe
"C:\Users\Admin\AppData\Local\Temp\05e406bcb04ba7fc8cb5a6644c43c806.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2908-0-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-3-0x0000000003B60000-0x0000000003B70000-memory.dmp

Filesize
64KB

Download
memory/2908-14-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-15-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-16-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-17-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2908-18-0x0000000003B60000-0x0000000003B70000-memory.dmp

Filesize
64KB

Download
memory/2908-19-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-20-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-21-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-23-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-24-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-25-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-26-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-27-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-28-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-29-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-30-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download
memory/2908-31-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing