14a22e0e6330666f016cbe5adf07e9a7c6f622fdbebd0f3bad193e7106b1c30a

General

Target

757e25213945169ba185938bddbd95a6.exe
Size

700KB
MD5

757e25213945169ba185938bddbd95a6
SHA1

7ed79761f6bc24e223b70776d4d3c144328da5bd
SHA256

14a22e0e6330666f016cbe5adf07e9a7c6f622fdbebd0f3bad193e7106b1c30a
SHA512

7abbf94adf8869debab70a627bdb1639d680bc1905ab4d5a08922ada5fc405bd2a5e0375a1ebc8647b0a22f2baf78fd946b7b7e6a17fd1983a558ec23cd06b36
SSDEEP

12288:cMJfsG35xx2yDGl5yfPgSPSs4/dXlDRoZVIlBPQhfE8P5imFJH:cMJfsKWyDwi6scdX1RsVwhKPXF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1564-1-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-5-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-4-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-6-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-83-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-82-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-87-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-86-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-85-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-88-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-104-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-107-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-118-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-120-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-119-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-137-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-131-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-138-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-139-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-140-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-141-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-144-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-145-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-146-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-147-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-148-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-149-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-150-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-151-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-154-0x0000000002350000-0x000000000249C000-memory.dmp	upx
behavioral2/memory/1564-155-0x0000000002350000-0x000000000249C000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~2\is240604625.log	757e25213945169ba185938bddbd95a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1564	757e25213945169ba185938bddbd95a6.exe
1564	757e25213945169ba185938bddbd95a6.exe
1564	757e25213945169ba185938bddbd95a6.exe
1564	757e25213945169ba185938bddbd95a6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1564	757e25213945169ba185938bddbd95a6.exe
Token: SeCreatePagefilePrivilege	1564	757e25213945169ba185938bddbd95a6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1564	757e25213945169ba185938bddbd95a6.exe
1564	757e25213945169ba185938bddbd95a6.exe

C:\Users\Admin\AppData\Local\Temp\757e25213945169ba185938bddbd95a6.exe
"C:\Users\Admin\AppData\Local\Temp\757e25213945169ba185938bddbd95a6.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ish240603671\bootstrap_57136.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\css\main.css

Filesize
6KB

MD5
794b69d3ab52585d981eac66f37e492f

SHA1
6c18c542e2e456d1e08635aa21f00a8a4e755b69

SHA256
b18b44d77a39148df4fa0c528f9ef85e9ee2253cee52746fb8f6988cb63828cf

SHA512
cecfae076152c03a7dcd4b14ff7f59f6f224094fb12e9a47803c8fc6a2eea52c5adedd49686dd78ba5edbd31e8f80c22eaea37c0a1e71601ad5a461d17ce57a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\images\BG.png

Filesize
86KB

MD5
c6b4da4b27ba612bf72fdf4cb53af433

SHA1
b194f471c600c8dc94fd9405b7bcdd62a60f600b

SHA256
e1ae28755e9f0c6eaec0ad8daa3ff43e5811409de2c94341b09946b5d599032f

SHA512
acf36640b1f567aabf8a0f660e921629060a5502650ba3514be5f458fd869290568cc8cbc63a2b69d527573d1df41c906327b01e049cdc052bd390fb6797c6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\images\Close.png

Filesize
1KB

MD5
b5680d31a09579da2f6e57dd2dc4b525

SHA1
caa1ebc4abbc86cdf33ef0cb496ee54f2c475575

SHA256
937a69b5d26a5dcacb1b81cd90a2d05fd55618af4e32a7f2e9550449f4163bbc

SHA512
d4a95c723b810355fb744120fb38660076b1724e6203c1f10f92165d2f097148bfa639279f933af329c44d8a1ed0eecaecbcad16f6502229ce3212fa50161ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\images\Color_Button.png

Filesize
846B

MD5
f6a0a0c082bc7ddc1e0e599493949e1f

SHA1
73b63bb6233e0e27b58ccdcb4ac32b05e36ce046

SHA256
b01fb9069f905b1f8ec3b72937e1a7a415fa62ee289aa79c68f65eee43bdd762

SHA512
ed5176bb258835a6346322a0ec0564557da28484a7bcc014ad1fcc337b14518b98e37475e41e6ae29cb724333e1c8471dd0f48bcf2a0d4cff522fb15e097716b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\images\Grey_Button.png

Filesize
1KB

MD5
aa1424f218bf3befbcca3c4c0e42a365

SHA1
c91d5dce4ebd543d905026577f8a05dff1d8357e

SHA256
e1a823582add59d1406fd36d3f7f86f98873e3201168e542cb49239d6c525ab0

SHA512
8ef2ea9613ff50bf028c9ef4611326d61b1cd07d01b89631faa2053449fab9a746e06e59a176dd5cda4f02f77fca8eedbb6e46ae4a78afa416ae8adb7ef0d93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240603671\images\Loader.gif

Filesize
10KB

MD5
57ca1a2085d82f0574e3ef740b9a5ead

SHA1
2974f4bf37231205a256f2648189a461e74869c0

SHA256
476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

SHA512
2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

Download Submit
memory/1564-85-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-1-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1564-88-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-87-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-82-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-84-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1564-104-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-107-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-118-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-120-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-119-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-83-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-137-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-6-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-4-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-5-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-86-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-131-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-138-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-139-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-140-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-141-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-144-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-145-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-146-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-147-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-148-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-149-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-150-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-151-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-154-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-155-0x0000000002350000-0x000000000249C000-memory.dmp

Filesize
1.3MB

Download
memory/1564-156-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing