e2659ff5c761f88cce226ee1cd836b7dd7942af391e8d12270c7cf9df7011069

Analysis

max time kernel
89s
max time network
120s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DNF˫-v1.0.exe
Size

488KB
MD5

c84e1fdf2e33f400d51f8cd33211ad93
SHA1

b97cc8dbd4ac05c98f5a991be28bfafcb4365e72
SHA256

62587d5ff64ea0faecaf8a8486faf41f516f78bb6fb7136e8d61a3a296e651a0
SHA512

f175c9b60675d8feb18a371735c1fe41e32e15015b4a4e9baff3a094e18400424c056187ae7a6d020d7f201f1556c10752582595759167184e2774c307c2d412
SSDEEP

12288:CEexgO0Rs15GwJHVWvLNjSIeD2S4YrMz6dDMR+uSoAlc0+Te:nO0611HkvLNeDhfniq

Score

9^/10

upx vmprotect

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	upx
behavioral1/memory/1128-60-0x0000000010000000-0x000000001003D000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1128-55-0x0000000000400000-0x000000000055F000-memory.dmp	vmprotect
behavioral1/memory/1128-57-0x0000000000400000-0x000000000055F000-memory.dmp	vmprotect
behavioral1/memory/1128-58-0x0000000000400000-0x000000000055F000-memory.dmp	vmprotect

Loads dropped DLL 1 IoCs

Processes:

DNF˫-v1.0.exe

pid process

1128 DNF˫-v1.0.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

DNF˫-v1.0.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	DNF˫-v1.0.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

DNF˫-v1.0.exe

pid	process
1128	DNF˫-v1.0.exe
1128	DNF˫-v1.0.exe
1128	DNF˫-v1.0.exe
1128	DNF˫-v1.0.exe
1128	DNF˫-v1.0.exe
1128	DNF˫-v1.0.exe

C:\Users\Admin\AppData\Local\Temp\DNF˫-v1.0.exe
"C:\Users\Admin\AppData\Local\Temp\DNF˫-v1.0.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/1128-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1128-55-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1128-57-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1128-58-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1128-60-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download