09df79cae620f367675b9e0dcb8fb9f476dbb1a0a1823030ff048409134367f8

General

Target

3b7c3fa4dc64a846828f389cfde2acf4.exe
Size

575KB
MD5

3b7c3fa4dc64a846828f389cfde2acf4
SHA1

c5831060b91dfbf2475dd0a1b8441dc46cff08bd
SHA256

09df79cae620f367675b9e0dcb8fb9f476dbb1a0a1823030ff048409134367f8
SHA512

cebb3b864bab42f22be0f4bf0d445c628f2849248ded3f491269d0da5f7e4b7a085fc45fb0d50954c8fb01cb8396f061b368b41fa0fd0029957fbdd46861df04
SSDEEP

12288:hAi2//5XeSJO4EUhO2GwEwmbG41UsarSGf18wWfDt2nAzc2Ob1Jz:6j1eSLEUhbEwWG4CL1d8p4AzNOhJz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-74-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-1-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-149-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-150-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-151-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-152-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-154-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-155-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-156-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-158-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-159-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-160-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-161-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-162-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-163-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-164-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-165-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral1/memory/3032-166-0x0000000000400000-0x000000000051E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	3b7c3fa4dc64a846828f389cfde2acf4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	3b7c3fa4dc64a846828f389cfde2acf4.exe
3032	3b7c3fa4dc64a846828f389cfde2acf4.exe

C:\Users\Admin\AppData\Local\Temp\3b7c3fa4dc64a846828f389cfde2acf4.exe
"C:\Users\Admin\AppData\Local\Temp\3b7c3fa4dc64a846828f389cfde2acf4.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ish259395685\images\progress-bg.png

Filesize
2KB

MD5
32a6846fe53388eb03be3ada2221297f

SHA1
1c1baec7b7fe7a420ccf68d3112384b44f8ba89e

SHA256
5c6d20c98c106bc6df49447b9939a90ba6a5e3c20d89ca0621677a7501bdb127

SHA512
79c4f3a72467b61c27d6e93415bae3fc61a9fde62aae4202ba8ed1de6328f5facc48092bfe57db70338a0a4b50f571d501eed04aed8b047d20aa28ee7446ce98

Download Submit
memory/3032-153-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/3032-155-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-78-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-118-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/3032-149-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-150-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-151-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-152-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-156-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-74-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-154-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-158-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-159-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-160-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-161-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-162-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-163-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-164-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-165-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3032-166-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing