ca8c8882bd8150b40266d159a4e6760b7b306ee2eb9376bbff9ca5092293f3a3

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

005a0ef9a2e600089891188f78271af3.exe
Size

324KB
MD5

005a0ef9a2e600089891188f78271af3
SHA1

2df4092ca9d1bf67b520314a4a0843068d2420fd
SHA256

ca8c8882bd8150b40266d159a4e6760b7b306ee2eb9376bbff9ca5092293f3a3
SHA512

85ab5b35dec8ea37bae04204f1fe6c9155532016a733875b5bc5db8df04a8cb40b20a44d4b9988a2e5935fcee8a8f5f80d0d0722384218fe90b8b5f945e92a2f
SSDEEP

6144:zr4EptEDgJBW6eZ1Y78WyMNLft+jXUUWAfVB5E2ul/rBee2NZD:zknDaBx/8WVIjkUd/q2U/rAe2NZ

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2576	pFiId06301.exe

Executes dropped EXE 1 IoCs

pid	Process
2576	pFiId06301.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	005a0ef9a2e600089891188f78271af3.exe
2232	005a0ef9a2e600089891188f78271af3.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-1-0x0000000000400000-0x0000000000584000-memory.dmp	upx
behavioral1/memory/2232-14-0x0000000000400000-0x0000000000584000-memory.dmp	upx
behavioral1/memory/2576-16-0x0000000000400000-0x0000000000584000-memory.dmp	upx
behavioral1/memory/2576-21-0x0000000000400000-0x0000000000584000-memory.dmp	upx
behavioral1/memory/2576-30-0x0000000000400000-0x0000000000584000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pFiId06301 = "C:\\ProgramData\\pFiId06301\\pFiId06301.exe"	pFiId06301.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	pFiId06301.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2232	005a0ef9a2e600089891188f78271af3.exe
2232	005a0ef9a2e600089891188f78271af3.exe
2576	pFiId06301.exe
2576	pFiId06301.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	005a0ef9a2e600089891188f78271af3.exe
Token: SeDebugPrivilege	2576	pFiId06301.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2576	pFiId06301.exe
2576	pFiId06301.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2576	pFiId06301.exe
2576	pFiId06301.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	pFiId06301.exe
2576	pFiId06301.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2576	2232	005a0ef9a2e600089891188f78271af3.exe	28
PID 2232 wrote to memory of 2576	2232	005a0ef9a2e600089891188f78271af3.exe	28
PID 2232 wrote to memory of 2576	2232	005a0ef9a2e600089891188f78271af3.exe	28
PID 2232 wrote to memory of 2576	2232	005a0ef9a2e600089891188f78271af3.exe	28

C:\Users\Admin\AppData\Local\Temp\005a0ef9a2e600089891188f78271af3.exe
"C:\Users\Admin\AppData\Local\Temp\005a0ef9a2e600089891188f78271af3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\ProgramData\pFiId06301\pFiId06301.exe
  "C:\ProgramData\pFiId06301\pFiId06301.exe" "C:\Users\Admin\AppData\Local\Temp\005a0ef9a2e600089891188f78271af3.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-1-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2232-0-0x0000000000590000-0x00000000005DD000-memory.dmp

Filesize
308KB

Download
memory/2232-14-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2576-16-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2576-21-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2576-30-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download