0a587b3e59095fc9f4b8efbb54bfa2087d9b04332e66929485afc6b1961ca015

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2023 12:49

Target

NA_NA_39e19801d45381exeexe_JC.exe
Size

2.2MB
MD5

39e19801d453818bbf076dbb3a1400c7
SHA1

4d214e1732ce75232fc828cae312081c7928696b
SHA256

0a587b3e59095fc9f4b8efbb54bfa2087d9b04332e66929485afc6b1961ca015
SHA512

94c498d4f3a155cfe2eb67cd05fcd1349b5334c227166a9c7a52942b81a8ea3b17c7d5c0ab47632265f50feacf8983ece217a1e47d969ffe0a8ab7ab97e03c58
SSDEEP

24576:F4YKL33onzQqK2vL+Jj/sRJF9PV6GrGkg0Rr5VkMrsTYhsCMAYQWfx5VNRem9KeJ:F6HozTKvJsnFVMkgGdu4ndBWNzEeBpR

Score

7^/10

aspackv2

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

Processes:

resource	yara_rule
C:\Program Files\IPADTV6.EXE	aspack_v212_v242
C:\Program Files\IPADTV6.EXE	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

IPADTV6.EXE

pid process

4724 IPADTV6.EXE
Drops file in Program Files directory 1 IoCs

Processes:

NA_NA_39e19801d45381exeexe_JC.exe

description ioc process

File created C:\Program Files\IPADTV6.EXE NA_NA_39e19801d45381exeexe_JC.exe

pid	process
4724	IPADTV6.EXE

description	ioc	process
File created	C:\Program Files\IPADTV6.EXE	NA_NA_39e19801d45381exeexe_JC.exe

Drops file in Windows directory 4 IoCs

Processes:

NA_NA_39e19801d45381exeexe_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	NA_NA_39e19801d45381exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	NA_NA_39e19801d45381exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	NA_NA_39e19801d45381exeexe_JC.exe
File created	C:\WINDOWS\Media\ActiveX.ocx	NA_NA_39e19801d45381exeexe_JC.exe

NTFS ADS 3 IoCs

Processes:

NA_NA_39e19801d45381exeexe_JC.exe

description	ioc	process
File created	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	NA_NA_39e19801d45381exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.mdb	NA_NA_39e19801d45381exeexe_JC.exe
File opened for modification	C:\WINDOWS\Media\Desktop.ini:dbase.ldb	NA_NA_39e19801d45381exeexe_JC.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

NA_NA_39e19801d45381exeexe_JC.exe

pid process

1108 NA_NA_39e19801d45381exeexe_JC.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

IPADTV6.EXE

pid process

4724 IPADTV6.EXE
4724 IPADTV6.EXE

pid	process
1108	NA_NA_39e19801d45381exeexe_JC.exe

pid	process
4724	IPADTV6.EXE
4724	IPADTV6.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

NA_NA_39e19801d45381exeexe_JC.exe

description	pid	process	target process
PID 1108 wrote to memory of 4724	1108	NA_NA_39e19801d45381exeexe_JC.exe	IPADTV6.EXE
PID 1108 wrote to memory of 4724	1108	NA_NA_39e19801d45381exeexe_JC.exe	IPADTV6.EXE
PID 1108 wrote to memory of 4724	1108	NA_NA_39e19801d45381exeexe_JC.exe	IPADTV6.EXE
PID 1108 wrote to memory of 3620	1108	NA_NA_39e19801d45381exeexe_JC.exe	regsvr32.exe
PID 1108 wrote to memory of 3620	1108	NA_NA_39e19801d45381exeexe_JC.exe	regsvr32.exe
PID 1108 wrote to memory of 3620	1108	NA_NA_39e19801d45381exeexe_JC.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\NA_NA_39e19801d45381exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_39e19801d45381exeexe_JC.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Program Files\IPADTV6.EXE
  "C:\Program Files\IPADTV6.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4724
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 C:\WINDOWS\Media\ActiveX.ocx /s
  2⤵
  PID:3620

C:\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\Program Files\IPADTV6.EXE

Filesize
304KB

MD5
b98bcc1c46673b77e7a4d214a7c2be51

SHA1
31382ca4ddd3f0eb9ffb542e834cebad1ae73e11

SHA256
9399dc52df64ea9d51585bd24f386c202a6b7fcfeececa5a6bc8e43e6ba93841

SHA512
a17fb97a411703a564dcbcec72d557b27ee31dc77f07098c976a3e36bb6138ea494785f1dd9c1daf1b1f7196c46e44d7c241b0068a7760472e082b974ebe6638

Download Submit
C:\WINDOWS\Media\ActiveX.ocx

Filesize
12B

MD5
ed851c2c1faaeed8d2d0a94dabcc5d7d

SHA1
897535ddd2486010b87acaf2a6f65ec5dbd54ea0

SHA256
0903d3dba088213b67f625339c2963c643ad7848b385f8497f03f6dc871e4e29

SHA512
df53cec619143812d279ed4da34dccd208f25c88cb356957b941b987b3f6772bd25e118d54daa1a2c7d4910d2b452e9dad0aa9bf88c72bae5d03e83f4b363d6c

Download Submit
memory/4724-137-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/4724-156-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4724-157-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download