9eff10d5c6a4155245c97f614364b1f3e96a3ed065c1762a0b9a7802058128a1

General

Target

5a9cdd82d1e927f26fe0052779c9c533.exe
Size

368KB
MD5

5a9cdd82d1e927f26fe0052779c9c533
SHA1

9eebf20c1a6e5f6a5f9efc9a724f41d67927b31f
SHA256

9eff10d5c6a4155245c97f614364b1f3e96a3ed065c1762a0b9a7802058128a1
SHA512

839a657fbeaef21ca5a3339fc2fbea92bf5c2b03c25459cae68427f04cc25f1dd0b001d50604ce5f354cffb6627fe6f132e2485f16ac07abcbf73f28b917269e
SSDEEP

6144:QSUllTpHeeh2jlBJsaRgGikFjXXtYt9+ZE2QYBVFsT5caPmNTmvAmAHkD:ILalBJj5jnetMnjj8maAmo0

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146944"	4qET8dHvX6Uf41.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1268-3-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/1268-2-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-8-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/1268-7-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-10-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-14-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-15-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-17-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-18-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-19-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-20-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-21-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-22-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-24-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-25-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-26-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-28-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-29-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-30-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-31-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-32-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-33-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-34-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2428-35-0x0000000000400000-0x00000000004A5000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\4qET8dHvX6Uf41	4qET8dHvX6Uf41.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4qET8dHvX6Uf41.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4qET8dHvX6Uf41.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	4qET8dHvX6Uf41.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	4qET8dHvX6Uf41.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2428	4qET8dHvX6Uf41.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1268	5a9cdd82d1e927f26fe0052779c9c533.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2428	4qET8dHvX6Uf41.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1268	5a9cdd82d1e927f26fe0052779c9c533.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe
2428	4qET8dHvX6Uf41.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2428	1268	5a9cdd82d1e927f26fe0052779c9c533.exe	28
PID 1268 wrote to memory of 2428	1268	5a9cdd82d1e927f26fe0052779c9c533.exe	28
PID 1268 wrote to memory of 2428	1268	5a9cdd82d1e927f26fe0052779c9c533.exe	28
PID 1268 wrote to memory of 2428	1268	5a9cdd82d1e927f26fe0052779c9c533.exe	28

C:\Users\Admin\AppData\Local\Temp\5a9cdd82d1e927f26fe0052779c9c533.exe
"C:\Users\Admin\AppData\Local\Temp\5a9cdd82d1e927f26fe0052779c9c533.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\PROGRA~3\4qET8dHvX6Uf41.exe
  C:\PROGRA~3\4qET8dHvX6Uf41.exe
  2⤵
  - Manipulates Digital Signatures
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-7-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1268-1-0x0000000000250000-0x0000000000293000-memory.dmp

Filesize
268KB

Download
memory/1268-3-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1268-2-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1268-4-0x0000000000250000-0x0000000000293000-memory.dmp

Filesize
268KB

Download
memory/1268-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-19-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-22-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-10-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-14-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-15-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-16-0x0000000000240000-0x0000000000283000-memory.dmp

Filesize
268KB

Download
memory/2428-17-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-18-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-8-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-20-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-21-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-6-0x0000000000240000-0x0000000000283000-memory.dmp

Filesize
268KB

Download
memory/2428-24-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-25-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-26-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-28-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-29-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-30-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-31-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-32-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-33-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-34-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2428-35-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download

Analysis

Sharing