a3acb5f0e8b775c0d3a2e2b069f9c2054ee2b304fa18e89a50b13d2dcd37f430

General

Target

8855378a8e7979cd12872f5b3715e890.exe
Size

1.2MB
MD5

8855378a8e7979cd12872f5b3715e890
SHA1

3413ae0a2cf1744943c5e9e5847e6eb133b57ce1
SHA256

a3acb5f0e8b775c0d3a2e2b069f9c2054ee2b304fa18e89a50b13d2dcd37f430
SHA512

620cf3b8cc79a03b58850c2cd47b8d6cfff48ed7518f70a1207b2dae7b3b0db6d2853c8ebdbb22a85b1691d74ee8c024285ca87e74e1c1c8acf52a9279c1d4c7
SSDEEP

24576:sSLLj7qDlluQ2dSm9X8IZy8HG8AyJJQnc79ETegwt:sgqDlgQ2B9stSGbyJWnBCgi

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3184-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x000a00000002311a-5.dat	upx
behavioral2/memory/1796-12-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2104-13-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2016-14-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3184-16-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1796-22-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2104-25-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2016-26-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	8855378a8e7979cd12872f5b3715e890.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\S:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\W:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\X:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\P:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\T:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\Y:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\E:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\I:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\K:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\N:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\A:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\B:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\H:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\V:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\Q:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\R:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\U:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\Z:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\G:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\L:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\M:	8855378a8e7979cd12872f5b3715e890.exe
File opened (read-only)	\??\O:	8855378a8e7979cd12872f5b3715e890.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\lingerie beastiality sleeping ejaculation .mpeg.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Microsoft Office\root\Templates\nude [free] feet 50+ .rar.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fetish fetish several models girly .rar.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\swedish beastiality hidden hairy .zip.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\canadian kicking fucking uncut black hairunshaved .rar.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Common Files\microsoft shared\russian blowjob several models traffic .mpeg.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\asian horse beastiality licking .avi.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\canadian gang bang [bangbus] latex .rar.exe	8855378a8e7979cd12872f5b3715e890.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\spanish cumshot lingerie voyeur legs sweet .mpg.exe	8855378a8e7979cd12872f5b3715e890.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	8855378a8e7979cd12872f5b3715e890.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	8855378a8e7979cd12872f5b3715e890.exe
3184	8855378a8e7979cd12872f5b3715e890.exe

C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe
"C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3184
- C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe
  "C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe"
  2⤵
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe
    "C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe"
    3⤵
    PID:2016
- C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe
  "C:\Users\Admin\AppData\Local\Temp\8855378a8e7979cd12872f5b3715e890.exe"
  2⤵
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fetish fetish several models girly .rar.exe

Filesize
16KB

MD5
f763db8b26e80af9e68bf769c8d4441a

SHA1
c49cb315e2cef81a76873b16fcabf2fa7f8e2a8a

SHA256
5f0553f2d9fbe0ee18108450dc1be64a1fa8b833fddb7483b3e2909302d3e3b4

SHA512
0a412fd74105282be0f6d0e16b782fc98ed47f29d56bc249567137273e6427d5941b93679b5cd4d1cf415a6e45c2030e8482dc6528f870d820a785379817dc03

Download Submit
memory/1796-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1796-22-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2016-14-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2016-26-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2104-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2104-25-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3184-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3184-16-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads