403f6204be4db0ac4cbe1bbe2067f7cca87de8b889862f3db02b48364c67be9d

Analysis

max time kernel
20s
max time network
23s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/12/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mirrored Temp.exe
Size

60.0MB
MD5

99cf7921de86b345d414004926480081
SHA1

776d3982615ad7e13c2f1cc8ce7b50d997342188
SHA256

403f6204be4db0ac4cbe1bbe2067f7cca87de8b889862f3db02b48364c67be9d
SHA512

9fc2016289acdf343eaef5952100c42d8adcf553b8f07235888fabf80ce2d9cba0f79a9fb60bc80fe9a2bea1a523a831a161f0416cedc5a59f4763bbd40839df
SSDEEP

1572864:RESUmxQqMrlpA+Ql4LMkxTivfS4qYaYcFJfJ:iSUmxykl0xenLuzFJR

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1700	Mirrored Temp.exe
1700	Mirrored Temp.exe
1700	Mirrored Temp.exe
1700	Mirrored Temp.exe
1700	Mirrored Temp.exe
1700	Mirrored Temp.exe
1700	Mirrored Temp.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000020925-790.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{504DB0B1-B573-11EF-9FF1-E28DDE128E91} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2532	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1700	2404	Mirrored Temp.exe	30
PID 2404 wrote to memory of 1700	2404	Mirrored Temp.exe	30
PID 2404 wrote to memory of 1700	2404	Mirrored Temp.exe	30
PID 1668 wrote to memory of 2656	1668	iexplore.exe	32
PID 1668 wrote to memory of 2656	1668	iexplore.exe	32
PID 1668 wrote to memory of 2656	1668	iexplore.exe	32
PID 1668 wrote to memory of 2656	1668	iexplore.exe	32
PID 2656 wrote to memory of 2532	2656	IEXPLORE.EXE	33
PID 2656 wrote to memory of 2532	2656	IEXPLORE.EXE	33
PID 2656 wrote to memory of 2532	2656	IEXPLORE.EXE	33
PID 2656 wrote to memory of 2532	2656	IEXPLORE.EXE	33

C:\Users\Admin\AppData\Local\Temp\Mirrored Temp.exe
"C:\Users\Admin\AppData\Local\Temp\Mirrored Temp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\Mirrored Temp.exe
  "C:\Users\Admin\AppData\Local\Temp\Mirrored Temp.exe"
  2⤵
  - Loads dropped DLL
  PID:1700

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d2c47376cc6a7ebe46454900cb4ad2c

SHA1
38e010b5a632b268fbbca96299956d102e4fa976

SHA256
b7c351d7a98117b083c03efd16a224f0992ceac6396040950576363ec48ed183

SHA512
f53bc0d44abe1e8ecfe365ba6b97cb6cc13e0384d5b6079ea236f43a15e53a7fc5debfe53524087cb0fa7e1319b17310dd81e89677625aadf22d71e12e9ccc88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
366bda95e9b4339b4f4bb27bcb69f1ef

SHA1
23eb749f45fa75ba85f6ec7df2d808d05c6504b7

SHA256
7e8893373b0246bf95d98968e10e567a884ff2ec7b211ec89c62820c4c0d1110

SHA512
56c3f0f3d218725f41cd3f0036612447aec09e682d91894e82d143602be20d9ab6202f5c7dd7b2b00c30409385676c2505ac4038c42730f662f29e8e0d0849f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bba92335bd57d96207b7695a53863e8c

SHA1
9aa7e5fde203ec90c62f14ca185bd323617aa7ff

SHA256
aabc386155d30bb75913844a545e5c7b974795a394be04468b99111f3b169807

SHA512
da0880601bf96ea624dedabdcaa1688b5538fe610f6f55ed5c74cbad80ae7f85fb80f44d98707a67c3e6ee201754de0ed87af0abc76cfc5a35bd8d882be9292b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1980f18af8894fda2a054d21e0a7743

SHA1
198cf9f6bcd57e914b4523dd4c60ecfeaba75ec0

SHA256
0b0ed2ab3642b6931801a383323bd72ec4aea27b68af94a496c30ae3ff27ed6d

SHA512
93e6db06a34affc8e4be42e10531a84fd52ad6030b7d34e2ae825876fb77f24c6cf975df8868e32f1ea6189bec75c9dbadcb33ac35cd2914df38b23bafd17366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33885f1eda350d52951cade48d696310

SHA1
75e759d4a5f2c869e962a9f675e0a435d8372d02

SHA256
e1f0dc426a7fe2d973eb3ae95236660451094cd967584eece32a5298a8fbf2e6

SHA512
574839ac8d3bd2a38374ed69936fab50a7db0db90b497284937830f580e5daaf10d6d658c441f03b95668f0763f855e518b6b432ce4fb45c4d693549bdf1f679

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e27d4aa51a67a459b8b9fc7211b281

SHA1
c58f45e8ab9641c2dd92b7611620f886d8958e53

SHA256
11b955e4d3e68282cd105ae89e6863d8a0bc1f376b89438ab4329f74916aec81

SHA512
f43bec648fa38b6b36c605bcdb37d6cc807b2e1557993252296c5722302283d7402dadab12f58b94df5af5128d48cb9fdd701bf238f799f8253b6e66c88185b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fac93b278322f281102fb608f0064630

SHA1
dd4c2c790b0f59f88a5118447dceba7e516112d2

SHA256
1e14c5afbc5d85df1c229bb2f1462a9fcd1f493604a96c8eb8b9448fb20b2401

SHA512
d5228cc61c22b939f8b2e4cb3ecc167f165ddb2e41f37827a4abe671a14e3bf9a61cc5038b8c59c0805c81aff259422f4c11098946efd7eccd26a2c29bc82886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db442a4ed2f355a4b56f00fe7a2171e0

SHA1
6940bbe6bc238f158b16f6affb4a217bf3b144c3

SHA256
30ba9fa75191088c47c698d50df27a2a0b96e2469388f830aa102f41e7f04ca5

SHA512
521f1260c3e7ec11d89f17f282b2ce4e38ee4313fc2732beae3c4f6b8977d3a5e3469b8f40294ec8cf43be6e05debe4e370c6b736514b3de6f76cf796dea01cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5554.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5612.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\python313.dll

Filesize
1.8MB

MD5
1490ed147cdd2c2fb09259d2b6c42161

SHA1
11c639b79b11d6c6d2a5910e602b199e8c63fffe

SHA256
c47c6432c0c202e885b344a18dcb4e392999c9a78eb987720b48e0fcff2e6a61

SHA512
1f086ab3e2029ad450a9be92d3e367342b6eed52e7581647e7b88596a1cbee1d9b478c41ce956396e4056974f1f3fe148192828bad3613ab58ed2c3e758b8a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24042\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24042\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
memory/1700-792-0x000007FEF61F0000-0x000007FEF6855000-memory.dmp

Filesize
6.4MB

Download