774e221dbf18bd36c5f46a5782bf2288ba88365634e402b56a097f425a25993a

General

Target

555893aef83c035c8602bbca0af564c7.exe
Size

120KB
MD5

555893aef83c035c8602bbca0af564c7
SHA1

3b228afa68753ad288f2632fc46f29c811cca978
SHA256

774e221dbf18bd36c5f46a5782bf2288ba88365634e402b56a097f425a25993a
SHA512

0a8c24c3dcf0dbc9f049cd531cf03e8e2814892240214cab6002d6b9199b2a35208b8e93fe14bd3f793eae4d380c6013900884eaf00b513003ddd582b71b56bb
SSDEEP

3072:RRqmefClXDGvWc66peoatKYjCDrnrBgN8jy:Pqme4DGvWc0naDrr

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2196	lsass.exe
4044	lsass.exe
3304	winhost.exe
5008	lsass.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2696-0-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2696-5-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2696-16-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3304-21-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/files/0x000b000000023222-19.dat	upx
behavioral2/memory/2696-23-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3304-25-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2696-33-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	lsass.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	lsass.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	lsass.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	lsass.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\winhost.exe	555893aef83c035c8602bbca0af564c7.exe
File opened for modification	C:\Windows\winhost.exe	555893aef83c035c8602bbca0af564c7.exe
File created	C:\Windows\lsass.exe	winhost.exe
File created	C:\Windows\lsass.exe	555893aef83c035c8602bbca0af564c7.exe
File created	C:\Windows\SMSS.bat	555893aef83c035c8602bbca0af564c7.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	lsass.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	lsass.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	lsass.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	lsass.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	lsass.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	555893aef83c035c8602bbca0af564c7.exe
2696	555893aef83c035c8602bbca0af564c7.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2196	2696	555893aef83c035c8602bbca0af564c7.exe	84
PID 2696 wrote to memory of 2196	2696	555893aef83c035c8602bbca0af564c7.exe	84
PID 2696 wrote to memory of 2196	2696	555893aef83c035c8602bbca0af564c7.exe	84
PID 2696 wrote to memory of 2416	2696	555893aef83c035c8602bbca0af564c7.exe	104
PID 2696 wrote to memory of 2416	2696	555893aef83c035c8602bbca0af564c7.exe	104
PID 2696 wrote to memory of 2416	2696	555893aef83c035c8602bbca0af564c7.exe	104
PID 2416 wrote to memory of 4044	2416	cmd.exe	103
PID 2416 wrote to memory of 4044	2416	cmd.exe	103
PID 2416 wrote to memory of 4044	2416	cmd.exe	103
PID 3304 wrote to memory of 5008	3304	winhost.exe	107
PID 3304 wrote to memory of 5008	3304	winhost.exe	107
PID 3304 wrote to memory of 5008	3304	winhost.exe	107

C:\Users\Admin\AppData\Local\Temp\555893aef83c035c8602bbca0af564c7.exe
"C:\Users\Admin\AppData\Local\Temp\555893aef83c035c8602bbca0af564c7.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SMSS.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416

C:\Windows\lsass.exe
C:\Windows\lsass.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\winhost.exe
C:\Windows\winhost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SMSS.bat

Filesize
31B

MD5
f7783aa57cf349f565232daaf7f19485

SHA1
5ec48d781e5d6ecacf108ad1789753ae80984dc3

SHA256
7ca2e292fbddcd05bd64c3b5f9528a282b8f479df61c7682846e85ded87cbb43

SHA512
e4bae708254025700bb372e5f9ec1809bd3796bf0fccc1ede110e769ccfffbc0abe555e0425221bec0e7c63e7bf710858bed924e585066432310ef6dde5a829a

Download Submit
C:\Windows\lsass.exe

Filesize
234KB

MD5
25bc4287d751ee42ebe3bffa8b780855

SHA1
07a9c5f7ecac647b8448d3c876747bddfe690805

SHA256
5d43f58cc4c8d837265235e679c2b12ee5074d8216948a4ae5cdfaaab0a76e37

SHA512
958a014c2a413f7fc31d54b961fb8dd461f64cf58995bca3411275e3e24e421f573267e9c5512ad3501230d284551f18121ef4e9bd633352a68e41982dff11e1

Download Submit
C:\Windows\lsass.exe

Filesize
92KB

MD5
4120ca3adacc7577949f6b42791dbcaf

SHA1
25a1312cba7addc52e82cff30a8fff26e5359eec

SHA256
a04388be66287396e1358486bc8c93a94a8ddd09685d9cbac1c98d799c1dcbbc

SHA512
b23ea8fd45ae2301713eb0471b7e85e3dc92444d4bc6e8065c63bb6c7f174b2c7cd555a8993be971f781049655e911a8376eb8a09cfe89af6c7efb7a4d111d3b

Download Submit
C:\Windows\winhost.exe

Filesize
120KB

MD5
555893aef83c035c8602bbca0af564c7

SHA1
3b228afa68753ad288f2632fc46f29c811cca978

SHA256
774e221dbf18bd36c5f46a5782bf2288ba88365634e402b56a097f425a25993a

SHA512
0a8c24c3dcf0dbc9f049cd531cf03e8e2814892240214cab6002d6b9199b2a35208b8e93fe14bd3f793eae4d380c6013900884eaf00b513003ddd582b71b56bb

Download Submit
memory/2196-10-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2196-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2196-44-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2196-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2696-23-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2696-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2696-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2696-33-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2696-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3304-21-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3304-25-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4044-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5008-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5008-35-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5008-43-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing