d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9

Analysis

max time kernel
89s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe
Size

364KB
MD5

923d12b6aabba0d902e86924ebabba74
SHA1

08b69ab557d56ced12f53e1683641f39789b797b
SHA256

d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9
SHA512

82392bed7faba080ff059e509b6aa9e347a9e558b945a363c5437bea5d74c4aa1147e17d43c443396e0b6225d52b415e11c76b9dbe0437f428e95767f1c25317
SSDEEP

6144:7wI036q0hZe74NNA2m7YAwJ2kjSoF3q9Th3GMK+/6+OH9:Z036q03e74bAb76Jsow3V/MH9

Score

9^/10

spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0005000000022dea-136.dat	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4532-135-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/files/0x0005000000022dea-136.dat	upx
behavioral2/memory/4532-138-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991334"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3121381829"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3128568112"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991334"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000f17586d3ce5b3d876342475fc088a259d0c462c83c9478d7337a70e1b6ecd893000000000e8000000002000020000000986ffb698296af6a710d7d3dcbd93409ff4fae931c3761cd3094b1fd7f7daf4320000000b22486285e6366d5b69ef965d9a4d33e49d91e88336454360025c9bfdd107bb740000000891271865fa5f66d17f75a399ff125f78e73d593c9a4a04f51b54dddb985c76bcc0915eb94584e2c0faa1aa0bb1f981c22829dc2926ecf96aaa8203f2fbf5486	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372968254"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000c76d9ec610041dbc7cec48d7e90f62c06f56caddc3b13af5b1d0f0edbdd0780b000000000e800000000200002000000060ecc979bda632a60dd502e0b54c672f0d8ce4a3fa218e0a4f5e684c1ff25d97200000007a8aa3d39e3f5d128968088d740a8ca8fb5951c778c7ef9f2d2350665b36e5e940000000daa36153a83e13ca3f8a599d1f1de7dd131ec60180be62617f0ce6f2f5084b135890c4216efc3fe2af92e84d2934940deb0df1180ddb4e309f2c9475b54ecbb7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3121381829"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ff33bbe6e3d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E583F157-4FD9-11ED-A0EE-62142853BA25} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991334"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e63fbbe6e3d801	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe
4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3860	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3860	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe
3860	iexplore.exe
3860	iexplore.exe
1792	IEXPLORE.EXE
1792	IEXPLORE.EXE
1792	IEXPLORE.EXE
1792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84
PID 4532 wrote to memory of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84
PID 4532 wrote to memory of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84
PID 4532 wrote to memory of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84
PID 4532 wrote to memory of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84
PID 4532 wrote to memory of 3860	4532	d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe	84
PID 3860 wrote to memory of 1792	3860	iexplore.exe	85
PID 3860 wrote to memory of 1792	3860	iexplore.exe	85
PID 3860 wrote to memory of 1792	3860	iexplore.exe	85

C:\Users\Admin\AppData\Local\Temp\d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe
"C:\Users\Admin\AppData\Local\Temp\d78804d8c9accd788fd772486c3e0a3c09fbc436dffc98de10ebd19ad6d2d4c9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Internet Explorer\iexplore.exe
  /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3860 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
d3ff0edeee7d1ea5754d8a290ae01189

SHA1
253ee24a4776d30bac0aedd7ea213adea6acb6f9

SHA256
e2e542a3681c428c021d38e608dffa43da666f6f3c53f623c21dc184639b222b

SHA512
ab14449059ae31856026e8d8cb0ec0b4158da0fd19f2a73940a159574a9084ce6a09ac05fb80ef3ab11cd9b1395dce021872215baced48f9e8a0bf7311000db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
493b4b9ccd3011ab0078de5375daeb33

SHA1
17a7b8a5510baeb99cc9ca13906900844e6627f7

SHA256
f2d20eca161fc13645bea429904611606bdff2fade2c0690b7dc90d094238b6f

SHA512
93adf050e6ae14b20979c4dee5a0b4a814f885aa10084c9513030a10989068c0aaf30d95d4754f9eae076ee7ca5623b779b2026d8aa387d532b92521588f2286

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
171KB

MD5
744dcc4cbbfbb18fe3878c4e769ec48f

SHA1
c1f2c56ee2d91203a01d3465f185295477a1217d

SHA256
33eb31a2a576e663474a895ff0190316c64a93d9ce05a55df0d53f9beeb61163

SHA512
706630be2ca09e574a7794e32e515a0a3f993643d034647b8cb976c1e7045e87e30362757cc65fcdb95f4a4327f0dcda3edc82ba84e5ed9115870a037e13af21

Download Submit
memory/4532-135-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4532-137-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/4532-138-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download