Malware Analysis Report

2024-10-23 21:11

Sample ID 240125-v87zescggl
Target 751e67a4989473abf91876bc5f5fe704
SHA256 fac6ae4446cfae1d79e6fc98d2679fe01ce737eaa275868f4184e951864fb370
Tags
upx kinsing loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fac6ae4446cfae1d79e6fc98d2679fe01ce737eaa275868f4184e951864fb370

Threat Level: Known bad

The file 751e67a4989473abf91876bc5f5fe704 was found to be: Known bad.

Malicious Activity Summary

upx kinsing loader

Kinsing

UPX packed file

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-25 17:40

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-25 17:40

Reported

2024-01-25 17:43

Platform

win7-20231215-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe

"C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe"

Network

N/A

Files

memory/760-0-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/760-1-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

MD5 c75583d86c4ce7ba75e3651e0b5bcce9
SHA1 b1a536a62ee86ac0ed4a4f9ca3152cd11a525a65
SHA256 4ce1156be542cd55b59f8c778f92550277688d9ab6929618cc9609054ba57f61
SHA512 c071b1704898723d9548fcbaecf47a8962fe7a9de81466bb13a2e2484a951e501fbbc4d5ebbe98baad71f7559c2fa0761c114c70c2a5a4b46885dbb3ef6cce6b

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

MD5 219073097031d9c1a95a1291d66f3a10
SHA1 2b7996b01d90b7f424f2a2e6063947461db4b2b2
SHA256 232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef
SHA512 9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

MD5 a4fdd77e182bd2fabe300a47b5617a35
SHA1 e002b335c75b5edefcd251962f61f53a2ab8e0f2
SHA256 8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b
SHA512 ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

memory/760-60-0x0000000005C70000-0x0000000005C90000-memory.dmp

memory/760-76-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/760-78-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-25 17:40

Reported

2024-01-25 17:43

Platform

win10v2004-20231222-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe"

Signatures

Kinsing

loader kinsing

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe

"C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3188 -ip 3188

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 2584

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 10.73.50.20.in-addr.arpa udp

Files

memory/3188-0-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/3188-1-0x0000000003260000-0x0000000003261000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

MD5 219073097031d9c1a95a1291d66f3a10
SHA1 2b7996b01d90b7f424f2a2e6063947461db4b2b2
SHA256 232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef
SHA512 9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

MD5 c75583d86c4ce7ba75e3651e0b5bcce9
SHA1 b1a536a62ee86ac0ed4a4f9ca3152cd11a525a65
SHA256 4ce1156be542cd55b59f8c778f92550277688d9ab6929618cc9609054ba57f61
SHA512 c071b1704898723d9548fcbaecf47a8962fe7a9de81466bb13a2e2484a951e501fbbc4d5ebbe98baad71f7559c2fa0761c114c70c2a5a4b46885dbb3ef6cce6b

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

MD5 a4fdd77e182bd2fabe300a47b5617a35
SHA1 e002b335c75b5edefcd251962f61f53a2ab8e0f2
SHA256 8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b
SHA512 ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

memory/3188-61-0x0000000000400000-0x00000000005B9000-memory.dmp