24b9367b0ab64a596bc362a9b30cecea72e381467f15a28b7f6a2f46e9aafe4a

Analysis

max time kernel
10s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

67058caeb23604220a89003173d6d7f8.exe
Size

661KB
MD5

67058caeb23604220a89003173d6d7f8
SHA1

d755920dda20f8b05a4676b96d6640632f6fa685
SHA256

24b9367b0ab64a596bc362a9b30cecea72e381467f15a28b7f6a2f46e9aafe4a
SHA512

1edc02aeb7a8aa8e840524fbc0ebaf35d14bdf3ed003f9ee7ed29e6f8645c0298b46ab27bb34240e3d2eff0fa4951e8441a425bcbf237d1fa569f9947244f5fc
SSDEEP

12288:WSI2A2u/WGo+n31k1OxVGL5xLz7MGuU/YuLW4htuM7Cy90Xg:nI72u/WGo41kSGtx37rYuLoyYg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1944-0-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-3-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-4-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-10-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-11-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-12-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-13-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-14-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-15-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-16-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1608-18-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1944-19-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1608-22-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1608-23-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1608-26-0x0000000001300000-0x00000000014C0000-memory.dmp	upx
behavioral1/memory/1608-28-0x0000000001300000-0x00000000014C0000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1944	67058caeb23604220a89003173d6d7f8.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	67058caeb23604220a89003173d6d7f8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\67058caeb23604220a89003173d6d7f8.exe = "11001"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	67058caeb23604220a89003173d6d7f8.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\ = "Setup.Application"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32\ = "ole32.dll"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID\ = "{017E057B-DACF-4A07-B878-E294565E3F90}"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\FLAGS	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\HELPDIR	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\ = "{F126C9FC-9299-40F2-BD42-C59023AD1E7F}"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\ = "{F126C9FC-9299-40F2-BD42-C59023AD1E7F}"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ = "Setup.Application"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID\ = "Setup.Application"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\67058caeb23604220a89003173d6d7f8.exe\""	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\67058caeb23604220a89003173d6d7f8.exe"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\HELPDIR\	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\ = "Setup"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\Version = "1.0"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ = "ISetup"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ = "ISetup"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\Version = "1.0"	67058caeb23604220a89003173d6d7f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\FLAGS\ = "0"	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0\win32	67058caeb23604220a89003173d6d7f8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib	67058caeb23604220a89003173d6d7f8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	67058caeb23604220a89003173d6d7f8.exe
1944	67058caeb23604220a89003173d6d7f8.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1944	67058caeb23604220a89003173d6d7f8.exe
1944	67058caeb23604220a89003173d6d7f8.exe
1944	67058caeb23604220a89003173d6d7f8.exe
1944	67058caeb23604220a89003173d6d7f8.exe
1944	67058caeb23604220a89003173d6d7f8.exe
1944	67058caeb23604220a89003173d6d7f8.exe

C:\Users\Admin\AppData\Local\Temp\67058caeb23604220a89003173d6d7f8.exe
"C:\Users\Admin\AppData\Local\Temp\67058caeb23604220a89003173d6d7f8.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1944
- C:\Users\Admin\AppData\Local\Temp\67058caeb23604220a89003173d6d7f8.exe
  "C:\Users\Admin\AppData\Local\Temp\67058caeb23604220a89003173d6d7f8.exe" /adm /recovermode
  2⤵
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-18-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1608-28-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1608-26-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1608-23-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1608-22-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-15-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-13-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-14-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-0-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-16-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-17-0x0000000005FB0000-0x0000000006170000-memory.dmp

Filesize
1.8MB

Download
memory/1944-12-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-19-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-11-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-10-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-4-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download
memory/1944-3-0x0000000001300000-0x00000000014C0000-memory.dmp

Filesize
1.8MB

Download