bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9

Analysis

max time kernel
6s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 20:03

Target

bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe
Size

34KB
MD5

1aa50b815fbd62b450c3aa53c21a3f30
SHA1

349eb2e30fc165dadbef7b049a7d29469c9f8fcc
SHA256

bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9
SHA512

cc9422324ad835384644fa5c5fbe39360b4f3a8cc607c8a2c43ccee9f1b5b033126deb9d89d9b445f3bd7a87b07e6ddfd1972af2acfbfd352d7abf1426663213
SSDEEP

768:Aer2rc6Kpwhqqrv1cnhCF08CjgaxrCzMK5jKGEkw/Dr8TH3u:YcJQqqqAtCTxCz/zWrS3u

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	upx
behavioral1/memory/1648-56-0x0000000000400000-0x0000000000416200-memory.dmp	upx
behavioral1/memory/1648-57-0x0000000000220000-0x0000000000231000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1648	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Ms_Info.Obj	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Ms_Info.Obj	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08315C1A-9BA9-4B7C-A432-26885F78DF28}	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08315C1A-9BA9-4B7C-A432-26885F78DF28}\	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08315C1A-9BA9-4B7C-A432-26885F78DF28}\InProcServer32	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08315C1A-9BA9-4B7C-A432-26885F78DF28}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\Ms_Info.Obj"	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08315C1A-9BA9-4B7C-A432-26885F78DF28}\InProcServer32\ThreadingModel = "Apartment"	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1648	bb8383fc875ac91dba8219e7a74ba929e9a930c3fd7afe35ca89f8b6ed5aa3f9.exe

\Program Files\Common Files\Microsoft Shared\MSInfo\Ms_Info.Obj

Filesize
17KB

MD5
1a48f2eb79e616ebfad400bb1068c329

SHA1
7645433e8fb7136402e297d5ac5376481428e9cc

SHA256
b3a204d2132921d726f2d86c37db8e5fca6491220470ff5e38fd1faa229b5698

SHA512
37e6154e75c7d675d422a5d58e03b2ef9f27f66536de561e6d2caf6dde3d257ec9136b710d636d9d07b6c8a74301a280bd6c969dcf75fdac6d168b0b3e5abcfc

Download Submit
memory/1648-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1648-56-0x0000000000400000-0x0000000000416200-memory.dmp

Filesize
88KB

Download
memory/1648-57-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download