8187583493231114cedbb51bb6bcb91b021605b198afa045cde60419b4be605e

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

080acdd527fe7a17c996d08eab850934.exe
Size

213KB
MD5

080acdd527fe7a17c996d08eab850934
SHA1

7a4c062737fe757025cce0fdbdd6300d7f6c2876
SHA256

8187583493231114cedbb51bb6bcb91b021605b198afa045cde60419b4be605e
SHA512

4bf5cc32b2aaa574e65c018d4787e729f1c61af005c4d07ced50146dc4414d584280a58dd27a78c60a1e48c37b960bd7bc4af705bce0849d1499f2c8e4dfa85a
SSDEEP

3072:y62MonpU9tw04VQJM6216XzD8areAEP/lQgWu6OWVcoGgsmOKh/v6nv6DNh:T2MAU9yfoFn7qJ3lm8ct1RD7

Score

7^/10

evasion trojan upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x000000000057A000-memory.dmp	upx
behavioral1/memory/2404-14-0x0000000000400000-0x000000000057A000-memory.dmp	upx
behavioral1/memory/2404-17-0x0000000000400000-0x000000000057A000-memory.dmp	upx
behavioral1/memory/2404-27-0x0000000000400000-0x000000000057A000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	080acdd527fe7a17c996d08eab850934.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410126920"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB2D5601-A74A-11EE-A628-46FAA8558A22} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006aa5cd7733cc8d459ed42b3bf1bb73d2151fb04a1d2fb52ce41d088209952369000000000e8000000002000020000000b242866006ea760c705d7102aed33d7391efa50ebafd9dd7d39a392176c9906a90000000476596a836de30b0d55ae8e77a5dd8ed3eaccb3bd99820565b3fc6b319298a56fbc10335d8c662f422414e176012c78af1c5ef2ece21daea90b31d8e7f8042172a9fe8c0e132b41daac2d57ca5aa0d9338393ff14b92ae1ff8414ed4deadbe7fdbb1ef9de02a06c781e0886f0f77f63590f58e6f9e9b05bfcf15f455b79edb12001389c1e55e9fb8065d0b32944bd0f0400000007cfdd24e64fb71d1cecfb1397a42c091e633c7c9e4bb8c1bd47793a61c18c8b47f3203592568a3a388cb36a2d5ab0fbe36363861e6995863df1a925a1ea36cb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	080acdd527fe7a17c996d08eab850934.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000653ceee9320a44231103ad771ee8a8097e74d00bb37507556f82d6ad813ad9b6000000000e8000000002000020000000e7bbb646bec591c98e03d1c2eda793806ea0d3ab400b1159874bda6c51848e6220000000b939007ed660bee69e370dd8742de2789465d9b7e8b7d9dcec6b68e5a186018a40000000c437590814219dd5732f09dc852180cdcceda75cc360f612b4038088cafd975c16d471d920b4a3f4c9bd4129f2e8db1e73263580c28c34a7b9cde43edeefa985	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fa0bc9573bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2404	080acdd527fe7a17c996d08eab850934.exe
2404	080acdd527fe7a17c996d08eab850934.exe
2404	080acdd527fe7a17c996d08eab850934.exe
2956	iexplore.exe
2956	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2956	2404	080acdd527fe7a17c996d08eab850934.exe	32
PID 2404 wrote to memory of 2956	2404	080acdd527fe7a17c996d08eab850934.exe	32
PID 2404 wrote to memory of 2956	2404	080acdd527fe7a17c996d08eab850934.exe	32
PID 2404 wrote to memory of 2956	2404	080acdd527fe7a17c996d08eab850934.exe	32
PID 2956 wrote to memory of 3016	2956	iexplore.exe	33
PID 2956 wrote to memory of 3016	2956	iexplore.exe	33
PID 2956 wrote to memory of 3016	2956	iexplore.exe	33
PID 2956 wrote to memory of 3016	2956	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\080acdd527fe7a17c996d08eab850934.exe
"C:\Users\Admin\AppData\Local\Temp\080acdd527fe7a17c996d08eab850934.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.gamecentersolution.com/downloadgame.aspx?CID=21157&AID=611
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
717ec94432690a4e35f7861a39c8988b

SHA1
cf68fb48a38a2413c778ac89eded8841cf0c55d5

SHA256
7a2f027decf3c4165b0d2fb116dd980a26e3a110be330df1615515084b44db15

SHA512
ce821f90d5ca7f908a51312fcde51be3de8fe574515451ffecfdb00992eb4d6b0a487e083f3da80fc039bbdfee0f5d30dd2c81c93ce7fcb50372c80b1e43e1d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a6f8942350f252494cd36fe98ae61d0

SHA1
323b772ce1f69617e87c50fb69a952f50496860f

SHA256
5711ef8ac1382dbe8af41a722adbce2e4447431a9c59295fd0eeb9b204fe0db2

SHA512
250cbe93e7ad9fe04a92d8e0cbaafdec3ee84eece5565636f51fa0e21fca97eed9dd1a886d02cb1cb4708654cd75dade33875b356faed714a4f8697cfbc410b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e099b71039df70ba77828ca29cbc09b7

SHA1
23c55bdbb15f7609d08cf64964a3ab14874aa899

SHA256
ce3c12c547c91d195331c8d04e64c10ca9ca09bac479059453f098f30ad2036c

SHA512
1e78b687ac715f33c4aee417e5893bc4f9522ea859c898ca3c828c299aa608b341acdd2db92f70581ccdb5c639560d4406e43f945194fe0f1839f09b0464a006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41f33ca76a17702b44cd1234ac606194

SHA1
8b6cebc4f4b50714b270d473d5b2ca96391987ef

SHA256
1630518d2e0072a5c49255417db1edcdb88cf6d41673bc74a9509be32973ba82

SHA512
9ffac7170b3bcd124fa9037841ccdebcddfa1a1e3baff8cfdc001b260c8e6ffda4087e7d41f3df691eba2d23d92163f51d5b4c08921be64883f03b33e092a980

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB18.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB4A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2404-0-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2404-14-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2404-17-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2404-27-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download