d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7

Analysis

max time kernel
137s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7.exe
Size

108KB
MD5

657fabcb9803eda028948c584d99ac0f
SHA1

cf9fc9c7d5daca76dff4efaddb307f4e8a9dc6b2
SHA256

d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7
SHA512

80c3caa243936ace8e8ca975eaef93bbbc765988bf9e4ee2a76b57d17244cd7f9850295647d70528547a398475868dda06b805fc18992ee134727e38427a29bb
SSDEEP

1536:i7Sd58O1HWrblE0jsxMQRQuIZ+aMmt4JL3CUAGD6W5KkMh6vg2P5jyRzsWKOM:i79ltQRclJt4hyp2KJhUDZmwWKf

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1800	avpsvr.exe
2044	avpcon.exe
1380	avpcon.exe
1288	avpcon.exe
1572	avpcon.exe
560	avpcon.exe
872	avpcon.exe
300	avpcon.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012311-54.dat	upx
behavioral1/memory/1800-55-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-56.dat	upx
behavioral1/files/0x000c0000000054a8-58.dat	upx
behavioral1/memory/1800-61-0x0000000000020000-0x0000000000033000-memory.dmp	upx
behavioral1/memory/2044-62-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-66.dat	upx
behavioral1/memory/1380-69-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-71.dat	upx
behavioral1/memory/1288-73-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/2044-77-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1380-76-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-80.dat	upx
behavioral1/memory/1572-81-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-85.dat	upx
behavioral1/memory/560-86-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-89.dat	upx
behavioral1/memory/872-90-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1800-93-0x0000000000020000-0x0000000000033000-memory.dmp	upx
behavioral1/files/0x000c0000000054a8-95.dat	upx
behavioral1/memory/300-96-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	avpcon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	avpcon.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\webs	avpcon.exe
File created	C:\Windows\avpcon.exe	d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7.exe
File created	C:\Windows\avpsvr.exe	d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7.exe
File opened for modification	C:\Windows\webs	avpcon.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	avpcon.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.xrwz.com"	avpcon.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1800	avpsvr.exe
2044	avpcon.exe
2044	avpcon.exe
2044	avpcon.exe
2044	avpcon.exe
1800	avpsvr.exe
1380	avpcon.exe
1380	avpcon.exe
1800	avpsvr.exe
1288	avpcon.exe
1800	avpsvr.exe
1572	avpcon.exe
1800	avpsvr.exe
560	avpcon.exe
1800	avpsvr.exe
872	avpcon.exe
1800	avpsvr.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2044	1800	avpsvr.exe	29
PID 1800 wrote to memory of 2044	1800	avpsvr.exe	29
PID 1800 wrote to memory of 2044	1800	avpsvr.exe	29
PID 1800 wrote to memory of 2044	1800	avpsvr.exe	29
PID 1800 wrote to memory of 1380	1800	avpsvr.exe	32
PID 1800 wrote to memory of 1380	1800	avpsvr.exe	32
PID 1800 wrote to memory of 1380	1800	avpsvr.exe	32
PID 1800 wrote to memory of 1380	1800	avpsvr.exe	32
PID 1800 wrote to memory of 1288	1800	avpsvr.exe	34
PID 1800 wrote to memory of 1288	1800	avpsvr.exe	34
PID 1800 wrote to memory of 1288	1800	avpsvr.exe	34
PID 1800 wrote to memory of 1288	1800	avpsvr.exe	34
PID 1800 wrote to memory of 1572	1800	avpsvr.exe	35
PID 1800 wrote to memory of 1572	1800	avpsvr.exe	35
PID 1800 wrote to memory of 1572	1800	avpsvr.exe	35
PID 1800 wrote to memory of 1572	1800	avpsvr.exe	35
PID 1800 wrote to memory of 560	1800	avpsvr.exe	36
PID 1800 wrote to memory of 560	1800	avpsvr.exe	36
PID 1800 wrote to memory of 560	1800	avpsvr.exe	36
PID 1800 wrote to memory of 560	1800	avpsvr.exe	36
PID 1800 wrote to memory of 872	1800	avpsvr.exe	37
PID 1800 wrote to memory of 872	1800	avpsvr.exe	37
PID 1800 wrote to memory of 872	1800	avpsvr.exe	37
PID 1800 wrote to memory of 872	1800	avpsvr.exe	37
PID 1800 wrote to memory of 300	1800	avpsvr.exe	38
PID 1800 wrote to memory of 300	1800	avpsvr.exe	38
PID 1800 wrote to memory of 300	1800	avpsvr.exe	38
PID 1800 wrote to memory of 300	1800	avpsvr.exe	38

C:\Users\Admin\AppData\Local\Temp\d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7.exe
"C:\Users\Admin\AppData\Local\Temp\d5685dfee1aa30e1df13e0592deadfb9312863c6063330ec67a1f2f2eda54bc7.exe"
1⤵
- Drops file in Windows directory
PID:1552

C:\Windows\avpsvr.exe
C:\Windows\avpsvr.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:560
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Windows\avpcon.exe
  C:\Windows\avpcon.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  PID:300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpcon.exe

Filesize
26KB

MD5
b8e7dc6bf6f11e67f443546b662d69f2

SHA1
47ff6f5266aaa8131569e4ff06046254a971d9da

SHA256
e4c249e2cccbc6be6324babacf026b21b56a0f262fafdf6c5d91656552ced477

SHA512
391fd4fb9e6cec538ce7110541cb9c553af23bc4f21637fff2022b927a5eed3440c08c5f195ae0b78a5aee9aab59c7931e065f8e81c67c92ebc7ee770791f1d9

Download Submit
C:\Windows\avpsvr.exe

Filesize
45KB

MD5
14eb92e040bba588cc160365e48e6313

SHA1
8acb97f3077bd90b30dd9812fceb52218823da71

SHA256
2ac6e7de5963e249726324d2fddf230082b551945ec78d047eaa0705980e764e

SHA512
34b16fb9e4bfd95c905885b6969334f17cc0f103ad7512ea9ed1ec1928369f209d1c656c6f87115ce372f23a9ba058091d81a486a139b87bf3705070885ee309

Download Submit
C:\Windows\webs

Filesize
26B

MD5
ee4a27fdf5c830ba6c618ed6a10096e0

SHA1
4e3f73812f53d6c1ca889a5144a64750c58df01b

SHA256
96183f27ae8f76b0a796435c103a495d8464a9afedfd12b203ca3002f26916a4

SHA512
ee769354d55af024b95cac49a135aec345a331c178488892d5d07b8d63965048a4ccb5fb5f3965039eb155709015a56a00715a42b39abacd459c4f2077c3848c

Download Submit
memory/300-96-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/560-86-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/872-90-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1288-73-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1380-69-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1380-76-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1572-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1800-64-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-87-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-97-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-75-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-82-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-83-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-74-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-68-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-63-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-78-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1800-60-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-61-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-91-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-92-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1800-93-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2044-59-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/2044-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2044-77-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download