7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c

General

Target

7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe
Size

2.1MB
MD5

2470779a75558873cd89d0269530481b
SHA1

5628be2194a2c9a1ab5e36f9b02faf2bb0df75b5
SHA256

7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c
SHA512

0a96602f7de228d4fd0cd29e701fc305ab69769843a1c804c5ecfdaa48d539f0e9d64a33da45349bf36139cf2a0d57d584438ac7d749fe81e3648b8b3464f356
SSDEEP

49152:YnUDCKvCncw72cmWZS3MtQsl/LHBeO87idUauX:qACKvLwSc7ZSEQsl/LH0O81

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2824-8-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-5-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-3-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-14-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-18-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-17-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-16-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-20-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-23-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-51-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-52-0x0000000000400000-0x000000000052C000-memory.dmp	upx
behavioral1/memory/2824-53-0x0000000000400000-0x000000000052C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe
2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe
2824	svchost.exe
2824	svchost.exe
2824	svchost.exe
2824	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30
PID 2732 wrote to memory of 2824	2732	7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe	30

C:\Users\Admin\AppData\Local\Temp\7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe
"C:\Users\Admin\AppData\Local\Temp\7124f824776260fcd2ab5cbfaa5d0b995ae6e020c8aff8b031a77a81aad7153c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-13-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2824-17-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-20-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-8-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-5-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-3-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-14-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2824-16-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-18-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-19-0x0000000074904000-0x0000000074905000-memory.dmp

Filesize
4KB

Download
memory/2824-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-23-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-51-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-52-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/2824-53-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing