86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b

General

Target

86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe
Size

33KB
MD5

05e7845ff746f2fad320b7fd336af640
SHA1

af0dc6403989c8a6f637748ef315438354b65f44
SHA256

86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b
SHA512

a5a1341ba097059e9dc300dc6475bd14664bf007d9b453b1ec5d8779edd216a773b72a755505751f5665f4a00a02d48d76f48ba8ef378d0af247892ff833fe21
SSDEEP

768:+NN/CbFGGnuUyXPNnbcuyD7UEh7WQMTNnkKsXmYPyRQKLf:g6hGMyfNnouy8Eh6JnkKs2Y6RQKz

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c0000000054a8-59.dat	acprotect
behavioral1/files/0x000c0000000054a8-58.dat	acprotect

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000c0000000054a8-59.dat	upx
behavioral1/files/0x000c0000000054a8-58.dat	upx
behavioral1/memory/668-61-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1772-60-0x00000000701A0000-0x00000000701AB000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1772	regsvr32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O352458.dll	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O352458.dll	regsvr32.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEFFD4A5-FC5D-4427-920D-E4917AAD09EE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B8A2D95-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B8A2D95-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32\Original = "C:\\Windows\\SysWOW64\\urlmon.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B8A2D95-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DA0O352458.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}\InprocServer32\Original = "C:\\Windows\\SysWOW64\\Dxtrans.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DA0O352458.dll"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1772	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28
PID 668 wrote to memory of 1772	668	86d2067d6e41794185b29cff8b16f6408337ca52828972394cfa91824e06935b.exe	28

C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O352458.dll

Filesize
15KB

MD5
66ad81d3844a657147da1dc24d085f3e

SHA1
9dd7d1312ddebb905a94800315c82915d1dbab36

SHA256
60d2036fb23157818494aac05ca3f292bf13ba6a0726b50c98d5683418ececcb

SHA512
66bc6e715dad52a010a1450e96fd71c8fccd80f89a42e19f9419a0457e3f2ff641d4c17f600147d4f5b4dfeefb3462660056539a3b294eb7893f079de77d6a97

Download Submit
\Program Files (x86)\Common Files\microsoft shared\DAO\DA0O352458.dll

Filesize
15KB

MD5
66ad81d3844a657147da1dc24d085f3e

SHA1
9dd7d1312ddebb905a94800315c82915d1dbab36

SHA256
60d2036fb23157818494aac05ca3f292bf13ba6a0726b50c98d5683418ececcb

SHA512
66bc6e715dad52a010a1450e96fd71c8fccd80f89a42e19f9419a0457e3f2ff641d4c17f600147d4f5b4dfeefb3462660056539a3b294eb7893f079de77d6a97

Download Submit
memory/668-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1772-57-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1772-60-0x00000000701A0000-0x00000000701AB000-memory.dmp

Filesize
44KB

Download