dd7a5be3c384c80a257e184fc4bdafd1937dc5f656bf609d28bcbc4240b11b2c

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50935f56ed6d3eebcb015437d0b93eb3.exe
Size

26KB
MD5

50935f56ed6d3eebcb015437d0b93eb3
SHA1

bb34f45b1dfee0fd3968d69c8af7154c5ca48039
SHA256

dd7a5be3c384c80a257e184fc4bdafd1937dc5f656bf609d28bcbc4240b11b2c
SHA512

08f8be2a5c185c21a07d560165bcc4356931e9135402b5dde19ade3a35d5505c2405635fd8f62380f44afddba2ae2356ddd45a9304d4ed56ecaa26bd188d52ab
SSDEEP

768:YqqMwNXdhvc9n0nibyokkBbFRKeoozjwMo2Y:YqIpct9dvFjKeXnwMo2

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000010000-0x0000000000026000-memory.dmp	upx
behavioral1/memory/2256-5-0x0000000000010000-0x0000000000026000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000653cbfcda317d735c47cb91a5efc5b4dfdedcbd99e41da877643996bf82197ce000000000e80000000020000200000000edc4b049e49540495b5cf88344c7fb45e0caed41d84b505dfeecab4aa668d329000000097e82a457632e5103d414ba20d17bc64c21e038c302b0a09381f366ee29343a08d7da1d8a019e977f3a4742a94cf2e757c8c541ee7de671794586fc6161a5e394131ce0dcc7d634809dca4012b87711ce7ba9a98ff7ce84561ef93de02f470d106e3ff3803e0eec2247c95fb180bb41bb85f095141d61292ffd301ebc934f2b6079830a246a9ce4b5098d1ff29fa893e4000000027b3d9b540c09f30e8974edc98a3352dcebb88b8ea96b4c3fc14db3252e6c9406a2e255b124449fb1bc78e8a17aa27506125e00b8d67428ac0b99fad1910b853	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{317D03D1-AFB5-11EE-8073-42DF7B237CB2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f270676c8725fa66efd968b9f9f7fe1a06a8407bd649349077a343376a5d6f9c000000000e8000000002000020000000070d79213a23febdab1e3d7bdb7554e40c09bb86aaa17a525de66ad0c60f52e920000000d609511611212d19ab4711172d3842da427f2ecd03b847fbddd67d15b85512e340000000e0d783ccef1f98201deefcef14d0d63412c867da6304ff45b8a5fb990568422efc40dbbc5ee4e88ab9b31513bc43bc2beff411fccd0fb01e598f3ae55338c1f9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10eca80ac243da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
2584	IEXPLORE.EXE
2584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2676	2256	50935f56ed6d3eebcb015437d0b93eb3.exe	28
PID 2256 wrote to memory of 2676	2256	50935f56ed6d3eebcb015437d0b93eb3.exe	28
PID 2256 wrote to memory of 2676	2256	50935f56ed6d3eebcb015437d0b93eb3.exe	28
PID 2256 wrote to memory of 2676	2256	50935f56ed6d3eebcb015437d0b93eb3.exe	28
PID 2948 wrote to memory of 2584	2948	iexplore.exe	31
PID 2948 wrote to memory of 2584	2948	iexplore.exe	31
PID 2948 wrote to memory of 2584	2948	iexplore.exe	31
PID 2948 wrote to memory of 2584	2948	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\50935f56ed6d3eebcb015437d0b93eb3.exe
"C:\Users\Admin\AppData\Local\Temp\50935f56ed6d3eebcb015437d0b93eb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43F4BB.js"
  2⤵
  PID:2676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b7b88cceee0fdcbaeaf3fbe7bd05464

SHA1
c1e9d9804a8b27edee6cbc8a213584e472140220

SHA256
8d9217b1e651cfbb9f8da2d5756c13349e0021184859498ec46dffb7373cafa4

SHA512
05d683cc3e3ccc52022ca37d4e9f9b9ee0bd5e8cf2adc15ac0a32907cd0776c9a852b9863b8f032a4c1510c6ff13469a4028fcba44670b31d1f689cf6c75c008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc873a9cd4b72e097a8d6fba9f49b4e6

SHA1
be35c40b2fa9cef377134bf92300a53dcd0b7582

SHA256
29cfc47c7e580505b77029d4bcd6e0078b45f33af76f8593fd2de7ed625aa202

SHA512
f5a7e770168f8e37f6a5bcc43d69600e89cff65f0c15108da291e491b59f0557819c1297e6b57a54d45bdd2a5c54c37e443d7dc48ce9b9beb34dea62bdeb899b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
936f1f25907728836e1b046b3ebbd9cc

SHA1
ac3471e64f2e8b7c04803d2885cdeeff70b84706

SHA256
2b5352c251843a7a175de3a74137e908af787ee38dca114f0a7e9db63e1cacfd

SHA512
4c23096fcba16d6de0acedf400b8cad83fffe015885cf8734e34f361102eb87dbc2fc234f85ec5ac87733dc507c4c8f2d9adcff6f238b2cb88cded67fbe0caf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077867001c1dc0c51f95fddf3d871908

SHA1
98303e7523977f441adca70eac4475776de62d04

SHA256
94b2e9e55ade491d320670c93c82df88201bf10462ea0f5f6d5e1a245aa5804f

SHA512
cbbe88b0228e159458bcbad204d426c73245bcc368019a1e1c9f0ace68dc7c359491bb620f1220e9bfa1bbf161586cc12d22387a4fb694a834e934d71692c051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd053a0a1f224264325430d6483265d3

SHA1
fc008c2712f7bc0351beb62b9eee2173a278ba67

SHA256
6793a5b89c44beb595ee88bca922b1abe13fd638c2e63fde63c057bdd28edb37

SHA512
204796ce82170c0e13b77e0c4fcf81e41d179f63a9ef0b44966887026f495707ccbafd92c1c6709d68137f0531f8b17cbe8f97901aba4767a084db0e14494dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b594a7a5dde1ded2fe3ec5723d0e7546

SHA1
3cbfa6934a9c563a6eb9aefc14835545ff796b69

SHA256
489f86ffcc25043095656b2c995735bff43b2b3293bb4d155450b072587307df

SHA512
270f1a00e6edbeca65fec8d0adc9c2548299bbc2d38154fbfc3b386c7eca084a5c7070a59a328e5e68e3a3630c5171a5219da66a83e46bd9ba0f281a6c3eb2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a3b8a30ff051d0568e182bd67572d35

SHA1
da20ddefacd68dcf9104ba188e3daa835ade0023

SHA256
2baa1d32509f5c7cffa77163c8d6bb37ddf19df24e349793fa0cdc87985004df

SHA512
55ba777d0f6b8c3c2aa7f1d581cdecbbaad88ecffcdfca154cbe09a6581473f0dc7e99b5d537b4f82df0288ccc39ea4392d4f2b491d77414cf05fac7007ddd35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
546413611041a83eadcf2c93b2087817

SHA1
190b3055b738533c50ccd95a1398cc7ebc4c7c61

SHA256
2603a42c43dab4c44bb6953e2912cd4889944b55711c004a7a34c3bd93c2274b

SHA512
ded8a90e9cad3d0d98ff92a9190a015622d94218df553422842c7354054a1038d5850dbb21ab0eb3199eefd0d794fbd8a2fdebcaf73c65b97902e56e876598b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c8b454b86ff5de151365d9c245ada15

SHA1
fc3fb9d3398adf7c95cfbb324cff497b587ead0b

SHA256
1865305cf5ac93fb6198ccdf71f5c541d0a64c5d1a621aa2bdd8386445a18895

SHA512
a78fa058918f1f9ed12db56132b1a0222c725ae926c8137fecb9bc498e3acfc2099d644a966bd52049f17edb461dc726c9bf3524b07500fadf78eb16a62dd0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\43F4BB.js

Filesize
5KB

MD5
1f6ab71b1d2ebc2abfca2e47e1d185b4

SHA1
2ad1b01b73a22588f5268f83cc6fc302dc9dbe6e

SHA256
34f709e36e27b1cf608e316a7a47d3ff16212f18ff1ee5a4883f41c5741f95c6

SHA512
a292be141f938c0de8fccb5de9156b7df0ca2c74e070ac3bbed5fa01bedc0af9e04285a526cd31bc5a788e736d24d50dbe0ad000cf023d471458ce7eff6a0c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE745.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7C6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2256-0-0x0000000000010000-0x0000000000026000-memory.dmp

Filesize
88KB

Download
memory/2256-5-0x0000000000010000-0x0000000000026000-memory.dmp

Filesize
88KB

Download
memory/2676-330-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download