290c4ccc0839e6fcbe34492ca1b916431085f0b5fa2277ff227d0dcd9c2f88df

General

Target

Photoshop-2023-Windows-25-0-es.exe
Size

2.9MB
MD5

2324572a1a166f0b57c4c55df94785f3
SHA1

1a0bcaf4609b4e2a7a31e7b99362ea38af5b0c65
SHA256

290c4ccc0839e6fcbe34492ca1b916431085f0b5fa2277ff227d0dcd9c2f88df
SHA512

4a8eedff66a352ffa1be37a6d4fc84f2d4101dc3d241fcd64b310a767fc111436e583f7089585bbc1928fc7847c4a9f8665029bbd34b4192dd90cf01d658d9a8
SSDEEP

49152:KdWYPac45TExljXrGGCzCWaUtqMbi6m9NGmVRD1sBA+wm+InK2vEo58WH0MdD:KdWjAxljXiGCGW9tbbQVRp9xm+yKtW84

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-0-0x0000000000A00000-0x0000000001352000-memory.dmp	upx
behavioral1/memory/2656-60-0x0000000000A00000-0x0000000001352000-memory.dmp	upx
behavioral1/memory/2656-80-0x0000000000A00000-0x0000000001352000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Photoshop-2023-Windows-25-0-es.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Photoshop-2023-Windows-25-0-es.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Photoshop-2023-Windows-25-0-es.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Photoshop-2023-Windows-25-0-es.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Photoshop-2023-Windows-25-0-es.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Photoshop-2023-Windows-25-0-es.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Photoshop-2023-Windows-25-0-es.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Photoshop-2023-Windows-25-0-es.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	Photoshop-2023-Windows-25-0-es.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Photoshop-2023-Windows-25-0-es.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Photoshop-2023-Windows-25-0-es.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Photoshop-2023-Windows-25-0-es.exe = "11001"	Photoshop-2023-Windows-25-0-es.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	Photoshop-2023-Windows-25-0-es.exe
2656	Photoshop-2023-Windows-25-0-es.exe

C:\Users\Admin\AppData\Local\Temp\Photoshop-2023-Windows-25-0-es.exe
"C:\Users\Admin\AppData\Local\Temp\Photoshop-2023-Windows-25-0-es.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{86D4AB6A-CAE8-474A-B972-1FFDC10C4D2D}\CCDInstaller.js

Filesize
1.2MB

MD5
e96bb3da47f4a3319b80f23051bdeb16

SHA1
c9913b052c5c7a59e100fe18357fddc1023161ea

SHA256
d69d7e68a706c60146a5b530368d7818599dbd39d071f181963a89945cff3c29

SHA512
6ac5bcdcdd2c70cb5094a6c985a81df520a6cf9f622c0697e00c0e3e4081cdb967f3da9df2a04072552dff2f70c43c9e84c2b6f3bf81f3720983859dff46f56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{86D4AB6A-CAE8-474A-B972-1FFDC10C4D2D}\index.html

Filesize
426B

MD5
a28ab17b18ff254173dfeef03245efd0

SHA1
c6ce20924565644601d4e0dd0fba9dde8dea5c77

SHA256
886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

SHA512
9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

Download Submit
memory/2656-0-0x0000000000A00000-0x0000000001352000-memory.dmp

Filesize
9.3MB

Download
memory/2656-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2656-32-0x0000000004BC0000-0x0000000004BE0000-memory.dmp

Filesize
128KB

Download
memory/2656-60-0x0000000000A00000-0x0000000001352000-memory.dmp

Filesize
9.3MB

Download
memory/2656-62-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2656-63-0x0000000004BC0000-0x0000000004BE0000-memory.dmp

Filesize
128KB

Download
memory/2656-80-0x0000000000A00000-0x0000000001352000-memory.dmp

Filesize
9.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads