9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49

Analysis

max time kernel
172s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe
Size

888KB
MD5

0bf9ffbf6b10620986856484b92d1b08
SHA1

46ee80aaf558e634a9d505f26e7df502835a21e4
SHA256

9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49
SHA512

bd843b9fa401ba727d992058ebe46816ca9db012ebec020bc940c940343b5639a40317c8a5125d9cd8b4239823ec351eb60bb0e398ca0956a54e81c46bac2f85
SSDEEP

24576:pq6Lg/sll3gKYGrbc84EphiXGZr1PcmqjHxhz4K2LkLJa91:pq8LPBHcJWZraHxaK2H1

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122f6-56.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1360-55-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/1360-60-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1360	9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1360	9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe
1360	9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe
1360	9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe

C:\Users\Admin\AppData\Local\Temp\9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe
"C:\Users\Admin\AppData\Local\Temp\9766cb94b9bcc427fb7cbdb3ed1403451f1047bda81a1331e0019e54590c8a49.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gek2E42.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/1360-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1360-57-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/1360-58-0x0000000000240000-0x0000000000267000-memory.dmp

Filesize
156KB

Download
memory/1360-59-0x0000000000340000-0x00000000003B3000-memory.dmp

Filesize
460KB

Download
memory/1360-60-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1360-76-0x0000000000340000-0x00000000003B3000-memory.dmp

Filesize
460KB

Download