80c26f68b8a46af63f3ee4b35c8150f1710d7aaa1cf8e39cb5c94ec29e9b7c11

General

Target

83dafce0560e7493e6dae82c270131a5.exe
Size

394KB
MD5

83dafce0560e7493e6dae82c270131a5
SHA1

5fdfe162b399a315508a55535c5b1f31012e4f39
SHA256

80c26f68b8a46af63f3ee4b35c8150f1710d7aaa1cf8e39cb5c94ec29e9b7c11
SHA512

cf2a9c2db3ee19a17979d2b3e92103566a691d59af8f376a56fcc1df1be12a06d47d40c6df0a7e54db4e2575486fd481e95560813721440105e06ba49196e18e
SSDEEP

6144:9bpGtfoVtScw2RCgrzItQB2bpGtfoVtScw:TGtAtScw3qEKBYGtAtScw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	ZSYIAUE.EXE

Loads dropped DLL 2 IoCs

pid	Process
2572	83dafce0560e7493e6dae82c270131a5.exe
2572	83dafce0560e7493e6dae82c270131a5.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ZSYIAUE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\INRFZTS.EXE \"%1\" %*"	ZSYIAUE.EXE

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2572-0-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x0038000000015cbd-10.dat	upx
behavioral1/memory/2360-28-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2572-30-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x000a00000001225c-26.dat	upx
behavioral1/files/0x000a00000001225c-22.dat	upx
behavioral1/files/0x000a00000001225c-20.dat	upx
behavioral1/memory/2360-31-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/files/0x000a00000001225c-32.dat	upx
behavioral1/memory/2360-36-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-38-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-39-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-40-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-41-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-44-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-47-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-48-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral1/memory/2360-49-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UEQEMX.EXE = "C:\\Users\\UEQEMX.EXE"	83dafce0560e7493e6dae82c270131a5.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\H:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\Q:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\R:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\K:	ZSYIAUE.EXE
File opened (read-only)	\??\P:	ZSYIAUE.EXE
File opened (read-only)	\??\T:	ZSYIAUE.EXE
File opened (read-only)	\??\K:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\U:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\N:	ZSYIAUE.EXE
File opened (read-only)	\??\S:	ZSYIAUE.EXE
File opened (read-only)	\??\V:	ZSYIAUE.EXE
File opened (read-only)	\??\N:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\T:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\E:	ZSYIAUE.EXE
File opened (read-only)	\??\I:	ZSYIAUE.EXE
File opened (read-only)	\??\Q:	ZSYIAUE.EXE
File opened (read-only)	\??\J:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\S:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\J:	ZSYIAUE.EXE
File opened (read-only)	\??\R:	ZSYIAUE.EXE
File opened (read-only)	\??\G:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\V:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\I:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\L:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\M:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\O:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\M:	ZSYIAUE.EXE
File opened (read-only)	\??\U:	ZSYIAUE.EXE
File opened (read-only)	\??\P:	83dafce0560e7493e6dae82c270131a5.exe
File opened (read-only)	\??\G:	ZSYIAUE.EXE
File opened (read-only)	\??\H:	ZSYIAUE.EXE
File opened (read-only)	\??\L:	ZSYIAUE.EXE
File opened (read-only)	\??\O:	ZSYIAUE.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\NSNV.EXE	83dafce0560e7493e6dae82c270131a5.exe
File opened for modification	C:\Program Files\NSNV.EXE	83dafce0560e7493e6dae82c270131a5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\QKCCHMP.EXE	83dafce0560e7493e6dae82c270131a5.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	83dafce0560e7493e6dae82c270131a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Program Files\\NSNV.EXE %1"	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	83dafce0560e7493e6dae82c270131a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Program Files\\NSNV.EXE \"%1\""	83dafce0560e7493e6dae82c270131a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Program Files\\NSNV.EXE %1"	83dafce0560e7493e6dae82c270131a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\INRFZTS.EXE \"%1\" %*"	ZSYIAUE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	83dafce0560e7493e6dae82c270131a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Users\\UEQEMX.EXE \"%1\" %*"	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ZSYIAUE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	83dafce0560e7493e6dae82c270131a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	83dafce0560e7493e6dae82c270131a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\NSNV.EXE %1"	83dafce0560e7493e6dae82c270131a5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	ZSYIAUE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2360	2572	83dafce0560e7493e6dae82c270131a5.exe	14
PID 2572 wrote to memory of 2360	2572	83dafce0560e7493e6dae82c270131a5.exe	14
PID 2572 wrote to memory of 2360	2572	83dafce0560e7493e6dae82c270131a5.exe	14
PID 2572 wrote to memory of 2360	2572	83dafce0560e7493e6dae82c270131a5.exe	14

C:\Users\ZSYIAUE.EXE
C:\Users\ZSYIAUE.EXE
1⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2360

C:\Users\Admin\AppData\Local\Temp\83dafce0560e7493e6dae82c270131a5.exe
"C:\Users\Admin\AppData\Local\Temp\83dafce0560e7493e6dae82c270131a5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\NSNV.EXE

Filesize
1KB

MD5
ed1267deeb39291b72351b89af5e81e0

SHA1
45ff406c7bf0fe98cd2eccd65cd353d108986ee3

SHA256
557fda6dd58b2e85e96b00524c163fc1c6c745fe5d8764926481bfc759993b12

SHA512
3b1b4942a1988f36e3377865088885613b5cfa2c2633b7f08df961e0370468b17325d73544581f1daf5d32b94a1cd9d0c335cdee7e7d9826dae3391e94b7257c

Download Submit
C:\Users\ZSYIAUE.EXE

Filesize
35KB

MD5
add5349691168f08cdfa1ddc5636271b

SHA1
b8ed7c61a51dc5aa08ef3abf71b9906d8a386dfe

SHA256
2aebf6db3fb072b595efc54a7eca44cf1c0fc7f3a1d4b10b82ee19b1be86a69c

SHA512
3581aa34f56f8ff04d6d2cd97cfcb16c20a0433e33cbbe8d81dec583b0f664e8fd725c03908cfc7f2a5939cb6dab73a5797ff77ee2b348c88687a0f4e0d4c083

Download Submit
C:\Users\ZSYIAUE.EXE

Filesize
9KB

MD5
d4574e60e00313aa6bf14261d789bdc7

SHA1
75a3dba1ff627c12c58b07a4668e6bbd44d48627

SHA256
d76a25081fa9105ac350e9e62f22dcc99dd1aba2c51d5776115708ddbcd9ac23

SHA512
1da522135ff6074a677cf6a4dec7848bd86fc65213349b95f4e3a69d370099677cefe1792b1162297022aad111b4780ff687bd2e98ace4449b8ebb3e8f87f7f3

Download Submit
\Users\ZSYIAUE.EXE

Filesize
13KB

MD5
eae72cded1c41fab13c5b50b2125dc89

SHA1
4b230c63f30a517dd5592a1c393d3cabb8fe695f

SHA256
9486b124e7051ae0f9c98e58d854f1d5630886d9e6ba71e4ecc910ea7cca2e45

SHA512
70c13e39f814072bac595e96ba6039da3924ffb6be2ec0c4edcfcf19014f3b4247a4743ef242908b5b5d1e85c5c79b8da387b7ce69c2ae5d3b0a9097cd1033b7

Download Submit
\Users\ZSYIAUE.EXE

Filesize
24KB

MD5
6352e879cc13c6c3afdefd10b69febfe

SHA1
89751bd0cc12fae631bbeb039a27533ec8908096

SHA256
d062a31f66a6ad14b62321e35e901705b13d9bbe859609705d2495e7a49845a9

SHA512
b793a01053d76fcb95d27c2adce1b34ea760775348270d60f7a0e882ce82e4a125538fc9d7e84616d0a8558ea2ad0b31acdc83082ae3509efc7aed6eaf9e8bb9

Download Submit
memory/2360-41-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-45-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-29-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2360-49-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-31-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-28-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-48-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-36-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-37-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2360-38-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-39-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-40-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-47-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-42-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-43-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-44-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2360-46-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2572-27-0x0000000001CF0000-0x0000000001D5E000-memory.dmp

Filesize
440KB

Download
memory/2572-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2572-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2572-30-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads