ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c

Analysis

max time kernel
141s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe
Size

7.5MB
MD5

d23a3377d3092fe853cc9b317e23301d
SHA1

ba1fb91600cb368e4d6df1590eb87a241403fdae
SHA256

ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c
SHA512

1faf7dde74241ad2baf42a8e076fce25149d5aad39d5ecc16b727dc94133232dd825d6f083d6a6a995dd808101e8d543529cd3df91c4d8973e56a9f7aed93f48
SSDEEP

196608:MsFLSQUBz3Yc+Sz38pp3GvU8OhqFRMmwwrqxCmjG:fSJIc+Sz35j3emwY4G

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\wdk21E3.tmp	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1760-56-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1760-68-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe

pid process

1760 ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe

pid	process
1760	ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe
1760	ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe
1760	ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe

C:\Users\Admin\AppData\Local\Temp\ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe
"C:\Users\Admin\AppData\Local\Temp\ffb426086b5539786462d5ea8c65f458627a84978bd4bf5c5925ca356086521c.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\wdk21E3.tmp
Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/1760-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1760-57-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/1760-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1760-58-0x0000000000330000-0x00000000003A3000-memory.dmp

Filesize
460KB

Download
memory/1760-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1760-69-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/1760-70-0x0000000000330000-0x00000000003A3000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads