ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dab

General

Target

ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
Size

680KB
MD5

f8d5a0c8688a29dfb946a80143e96c10
SHA1

dd25cc2ac87b05e2306755ea8237fa70f15d5349
SHA256

ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dab
SHA512

91ec3bf4b66020780f82379a51fdb3537034dbbefdf72341e62766a00a4145818c078da2ed4cb68e033ded632c4f4017c549a27bccdf409cb30e72e7a6dcf221
SSDEEP

12288:d3DAAw0jmgI7E8Gq2VvhxNOMfg33sUKpfcsFmcyouqa3wTQip7:d3DXw0agI7EjVvHXg33OpfPFmcyouqaE

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1376-0-0x0000000000400000-0x00000000005B6000-memory.dmp	upx
behavioral2/memory/1376-64-0x0000000000400000-0x00000000005B6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1376	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\IESettingSync	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
1376	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
1376	ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe

C:\Users\Admin\AppData\Local\Temp\ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe
"C:\Users\Admin\AppData\Local\Temp\ec5849b20e9e1fdda68f41166fbc6fad7c54949d67a4f8a1b9485ca601574dabN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 2624
  2⤵
  - Program crash
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1376 -ip 1376
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html

Filesize
10KB

MD5
6e5421d83970f38a6de556f61f5bf685

SHA1
4732a3dd0b17fb1557d4b20c213603b1bc3ac4a2

SHA256
55a1b881165efda06cd5305b4b2814b64544d1e41c0beb4e8364b21dc78cd0a5

SHA512
f37a6f01c5355a22236d9dd4da6d8f99f5e897ae48e940a9632b433aa7b9ae5a65f607f3d6cfa475dbd810c9a36c06acfbee38b0d09a60a12a7db62dd0894481

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js

Filesize
202KB

MD5
a4fdd77e182bd2fabe300a47b5617a35

SHA1
e002b335c75b5edefcd251962f61f53a2ab8e0f2

SHA256
8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b

SHA512
ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js

Filesize
89KB

MD5
219073097031d9c1a95a1291d66f3a10

SHA1
2b7996b01d90b7f424f2a2e6063947461db4b2b2

SHA256
232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef

SHA512
9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5

Download Submit
memory/1376-0-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download
memory/1376-1-0x00000000058D0000-0x00000000058D1000-memory.dmp

Filesize
4KB

Download
memory/1376-64-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing