a3bb9b4090251112e1bc75a6cfa453c17008f495732dfaf1b57697a31bf453ce

General

Target

0f8e8bd5344501465561ea05cfdaf556.exe
Size

225KB
MD5

0f8e8bd5344501465561ea05cfdaf556
SHA1

f57672d10a0d3d6bd30791330088cbaedb82a362
SHA256

a3bb9b4090251112e1bc75a6cfa453c17008f495732dfaf1b57697a31bf453ce
SHA512

56b3c3920afb24024ccb0a60a123463c6418116de6334dbce7a02c3d120c1d8ba964dbf6d7d8ac5ba84dfd17c2f3fb9e59ae018d25271daa9fc4286e92b54740
SSDEEP

6144:U8ww6nXCqZ+dV6SR9zfyOuOEuF6vaemGcsoS:U8wwYXxMdV6SnTyO+YIcsoS

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

n6205vcy.exe

pid process

1640 n6205vcy.exe
Loads dropped DLL 1 IoCs

Processes:

0f8e8bd5344501465561ea05cfdaf556.exe

pid process

1436 0f8e8bd5344501465561ea05cfdaf556.exe

pid	process
1436	0f8e8bd5344501465561ea05cfdaf556.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1436-0-0x0000000000400000-0x000000000044F000-memory.dmp	upx
\Users\Admin\AppData\Roaming\n6205vcy.exe	upx
behavioral1/memory/1640-11-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/1436-6-0x00000000002B0000-0x00000000002FF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0f8e8bd5344501465561ea05cfdaf556.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\n6205vcy.exe = "C:\\Users\\Admin\\AppData\\Roaming\\n6205vcy.exe"	0f8e8bd5344501465561ea05cfdaf556.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

n6205vcy.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	n6205vcy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	n6205vcy.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	n6205vcy.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

n6205vcy.exe

pid	process
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe
1640	n6205vcy.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

n6205vcy.exe

pid process

1640 n6205vcy.exe
1640 n6205vcy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0f8e8bd5344501465561ea05cfdaf556.exe

description	pid	process	target process
PID 1436 wrote to memory of 1640	1436	0f8e8bd5344501465561ea05cfdaf556.exe	n6205vcy.exe
PID 1436 wrote to memory of 1640	1436	0f8e8bd5344501465561ea05cfdaf556.exe	n6205vcy.exe
PID 1436 wrote to memory of 1640	1436	0f8e8bd5344501465561ea05cfdaf556.exe	n6205vcy.exe
PID 1436 wrote to memory of 1640	1436	0f8e8bd5344501465561ea05cfdaf556.exe	n6205vcy.exe

C:\Users\Admin\AppData\Local\Temp\0f8e8bd5344501465561ea05cfdaf556.exe
"C:\Users\Admin\AppData\Local\Temp\0f8e8bd5344501465561ea05cfdaf556.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Roaming\n6205vcy.exe
"C:\Users\Admin\AppData\Roaming\n6205vcy.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\ib2[1].htm
Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
\Users\Admin\AppData\Roaming\n6205vcy.exe
Filesize
225KB

MD5
0f8e8bd5344501465561ea05cfdaf556

SHA1
f57672d10a0d3d6bd30791330088cbaedb82a362

SHA256
a3bb9b4090251112e1bc75a6cfa453c17008f495732dfaf1b57697a31bf453ce

SHA512
56b3c3920afb24024ccb0a60a123463c6418116de6334dbce7a02c3d120c1d8ba964dbf6d7d8ac5ba84dfd17c2f3fb9e59ae018d25271daa9fc4286e92b54740

Download Submit
memory/1436-1-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1436-2-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1436-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1436-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1436-6-0x00000000002B0000-0x00000000002FF000-memory.dmp

Filesize
316KB

Download
memory/1640-39-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-55-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-35-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-43-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-47-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-51-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-31-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-58-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-62-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-66-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-70-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-75-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-79-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1640-83-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads