6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69

General

Target

6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
Size

663KB
MD5

eb4efeb91f445673c1b3013d61fe8950
SHA1

755690bc857931360137afcf5a359e317d3be064
SHA256

6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69
SHA512

905f687dc66a9ddbc1de71b1eacc22e28f4d278c4434f7d38713f5ea9f7d982eb27843fdfb9b38475057bc6b91f2d5b462915f503664ff9dd80af831230b105c
SSDEEP

12288:3qhjSwOV6+IY7cVSSLM8vX2xNOMfe33sUP8gO4wPhKCcXYR:3qhiV6p7VXLRvXGXe33IgS5cXYR

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2060-0-0x0000000000400000-0x00000000005A7000-memory.dmp	upx
behavioral2/memory/2060-61-0x0000000000400000-0x00000000005A7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
184	2060	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\IESettingSync	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
2060	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
2060	6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe

C:\Users\Admin\AppData\Local\Temp\6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe
"C:\Users\Admin\AppData\Local\Temp\6dc69c861a07f8fdd59584572c21f81c3c9c4f21020761810695d1b86b031a69N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 2560
  2⤵
  - Program crash
  PID:184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2060 -ip 2060
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

Filesize
11KB

MD5
34b7cb680074f4861f18d26dd667d007

SHA1
34fd8976a3901c5d179fdd029c1ba98962e82d95

SHA256
c48054a38c65de48a402aae4801c45e9f74dff33710d57683629a87e777704ad

SHA512
7ab07729d5bbdf424154a285ee07697b282fc28afaa6cb1c16199ad99a0a695631ca8a431a5041776b971527da6284e03ca041dda935b2b321cfd524fcd51e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

Filesize
202KB

MD5
a4fdd77e182bd2fabe300a47b5617a35

SHA1
e002b335c75b5edefcd251962f61f53a2ab8e0f2

SHA256
8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b

SHA512
ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

Filesize
89KB

MD5
219073097031d9c1a95a1291d66f3a10

SHA1
2b7996b01d90b7f424f2a2e6063947461db4b2b2

SHA256
232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef

SHA512
9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

Download Submit
memory/2060-0-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2060-1-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/2060-61-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing