Resubmissions
25/04/2023, 16:11
230425-tmxqwsdc6w 725/04/2023, 15:53
230425-tbzq4sbc64 725/04/2023, 14:27
230425-rsv35sag93 725/04/2023, 14:26
230425-rrwchsag87 7Analysis
-
max time kernel
297s -
max time network
295s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2023, 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
877_de.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
7 signatures
1200 seconds
General
-
Target
877_de.exe
-
Size
45KB
-
MD5
6cda54d3bc470583ac95532119570ffe
-
SHA1
37bb75119cf20d775265fc56dd9843e9a57fb205
-
SHA256
923e95b7ca5559b47d2c12a4c75a540943266aa39cde60c3a629a95a6b85a0a3
-
SHA512
65cc0e85931d237f92261be586a31e1e75963267ba6c518fbf55e6d5fa35c72f94fff5107e2d54c8d34dbf576a52861042e93601e1a136844ade5f98ad2089f2
-
SSDEEP
768:3KHHfuj+ZHaIQB9uz7SXnJHw+NVTGzxpHWilnSFIy1DYVugsTTm8oZrzqJIEo1iN:aHK+ZHaTXNZOxpZTy1IsTTm84rzr1lNY
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000023162-134.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2672 877_de.exe -
resource yara_rule behavioral1/files/0x0008000000023162-134.dat upx behavioral1/memory/2672-140-0x0000000075000000-0x0000000075007000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gxjrk = "C:\\Windows\\system32\\yizf.exe" 877_de.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\yizf.exe 877_de.exe File created C:\Windows\SysWOW64\vjpc.dll 877_de.exe File opened for modification C:\Windows\SysWOW64\yizf.exe 877_de.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\cnxb.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\zcclte.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\hjet.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\sbdb.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\gibjslrbj.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\warhyb.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\kdhukinmzmok.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\zdnibzmiijo.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\bfbg.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\qtfvab.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\jgagtmuhdfyk.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\rojgonn.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\zbuimes.zip 877_de.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\pxrqp.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\ububvetoqo.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\safcpjkatuc.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\cwauwbbpmymj.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\rjgcxuleouihy.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ctxcpxapcwk.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\iktpticsqf.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\AppxMetadata\vhmhanvnwgfai.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\ukpkckvhkzet.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-sl\kcitdiak.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\khfqtsyzn.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\khlhasae.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\ozmzvoerusnn.zip 877_de.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\xyyoobzyeit.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\skenmfmr.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\enjkq.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\ejkkhnen.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\qgeycd.exe 877_de.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\tulfkukcj.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\hlhndskulht.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\lzsw.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\euygoidyqa.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\ibvdtbwrmd.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\ghgjblhbrhcgu.exe 877_de.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\aftsr.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\czqhbrkr.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\guwdhk.exe 877_de.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\zhbjwckvgabl.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sk-sk\grmrp.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\siboiisjesw.exe 877_de.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Comprehensive\gfzcnxvrmg.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\zijqpkb.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\wmbx.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\qdqfsf.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\wetyvtwg.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\bfhiekyoduiy.exe 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\ghohytig.zip 877_de.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\vvwmyo.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\zhxxyavxcm.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\bluiszgxfdgl.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\dhqolscliviau.zip 877_de.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ysychykipx.exe 877_de.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\agausgbcwi.exe 877_de.exe File created C:\Program Files\Windows Media Player\de-DE\jtoy.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\cuxs.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\npkhjkdkcv.exe 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\vlmcyqvxv.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\gozhvzrkf.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\ehyevpmetz.zip 877_de.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\wbgwrleijjw.zip 877_de.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\rqsmcmaolch.zip 877_de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe 2672 877_de.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD56cda54d3bc470583ac95532119570ffe
SHA137bb75119cf20d775265fc56dd9843e9a57fb205
SHA256923e95b7ca5559b47d2c12a4c75a540943266aa39cde60c3a629a95a6b85a0a3
SHA51265cc0e85931d237f92261be586a31e1e75963267ba6c518fbf55e6d5fa35c72f94fff5107e2d54c8d34dbf576a52861042e93601e1a136844ade5f98ad2089f2
-
Filesize
9KB
MD59f69bf9c221dd2ad4dc39a519e2a051d
SHA182522a1f4f60dae639d6bca1446af70a469d3887
SHA25629a0ecacce0bd9981fb289c130f1b0b816458f1a46fe7dc2db7b77317b8e97ab
SHA512d6f556a13cf12d61776115e570d298bfef1030db39be96ed9d222ffdaa2441364e7c7a6e02d393fb55d8137db25e8b9eb41afc4b9a6349f93e4ec2059b84da7c