Analysis

  • max time kernel
    164s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 08:24

General

  • Target

    c4756983ad677783a25b3d00d80d61eb81e2e2a4a99ff0d5a59118205ca0b2ff.exe

  • Size

    5.3MB

  • MD5

    54b7b7025ffab6172ba8a06426a4090d

  • SHA1

    a67d18a749661ff91d8f7c34187171e6ecaf375e

  • SHA256

    c4756983ad677783a25b3d00d80d61eb81e2e2a4a99ff0d5a59118205ca0b2ff

  • SHA512

    89852d13503d272109dbe8053bdae3e87c57dda59e743778fa10b2a506892e4aa2f0cdada42228221216723e53489ba4b5915f86cc2312bf60d573eb9d98003e

  • SSDEEP

    98304:diCh3EzxvNmwEpczAqX/zEjy7eFaddXNJz:diCuBzNX/ziyM6fJz

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 4 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4756983ad677783a25b3d00d80d61eb81e2e2a4a99ff0d5a59118205ca0b2ff.exe
    "C:\Users\Admin\AppData\Local\Temp\c4756983ad677783a25b3d00d80d61eb81e2e2a4a99ff0d5a59118205ca0b2ff.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s lw.dll
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 C:\Users\Admin\AppData\Local\Temp\TSPlug.dll /s
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:4076

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\TSPlug.dll

          Filesize

          722KB

          MD5

          8fb19475092ed167946d946cd9f95b96

          SHA1

          1fe7a9447854ba2e0e6cef72dfb033a300393926

          SHA256

          2cd87c25f6f75313821158e777f0e272a7a0da8b2f530ea69f258831689bc037

          SHA512

          c49a92d2daaadecd441276f4ad6b36912a2546108a548d82cc053b50b1acaaf1437ee98b5004135756792af4c993910252de763a2fab658815b226a533366db8

        • C:\Users\Admin\AppData\Local\Temp\TSPlug.dll

          Filesize

          722KB

          MD5

          8fb19475092ed167946d946cd9f95b96

          SHA1

          1fe7a9447854ba2e0e6cef72dfb033a300393926

          SHA256

          2cd87c25f6f75313821158e777f0e272a7a0da8b2f530ea69f258831689bc037

          SHA512

          c49a92d2daaadecd441276f4ad6b36912a2546108a548d82cc053b50b1acaaf1437ee98b5004135756792af4c993910252de763a2fab658815b226a533366db8

        • C:\Users\Admin\AppData\Local\Temp\TSPlug.dll

          Filesize

          722KB

          MD5

          8fb19475092ed167946d946cd9f95b96

          SHA1

          1fe7a9447854ba2e0e6cef72dfb033a300393926

          SHA256

          2cd87c25f6f75313821158e777f0e272a7a0da8b2f530ea69f258831689bc037

          SHA512

          c49a92d2daaadecd441276f4ad6b36912a2546108a548d82cc053b50b1acaaf1437ee98b5004135756792af4c993910252de763a2fab658815b226a533366db8

        • C:\Windows\lw.dll

          Filesize

          2.5MB

          MD5

          554acd7a8b4d60ace2f647e6a358ddf0

          SHA1

          9198b2911e0669785617d45b513fc87824ba468f

          SHA256

          6ac5a03985a9305a5660c5823e221e40736427851ce9d99c57fb346a00d44322

          SHA512

          a897064ffdabb027aac18088f418f859a54f6b892656708f1ae1a4353040d3cfe3e840586c77d1f4b9b115958b39d16dbd0e49b351acf631768e754275120d64

        • C:\Windows\lw.dll

          Filesize

          2.5MB

          MD5

          554acd7a8b4d60ace2f647e6a358ddf0

          SHA1

          9198b2911e0669785617d45b513fc87824ba468f

          SHA256

          6ac5a03985a9305a5660c5823e221e40736427851ce9d99c57fb346a00d44322

          SHA512

          a897064ffdabb027aac18088f418f859a54f6b892656708f1ae1a4353040d3cfe3e840586c77d1f4b9b115958b39d16dbd0e49b351acf631768e754275120d64

        • C:\Windows\lw.dll

          Filesize

          2.5MB

          MD5

          554acd7a8b4d60ace2f647e6a358ddf0

          SHA1

          9198b2911e0669785617d45b513fc87824ba468f

          SHA256

          6ac5a03985a9305a5660c5823e221e40736427851ce9d99c57fb346a00d44322

          SHA512

          a897064ffdabb027aac18088f418f859a54f6b892656708f1ae1a4353040d3cfe3e840586c77d1f4b9b115958b39d16dbd0e49b351acf631768e754275120d64

        • memory/2712-7-0x0000000002D60000-0x0000000002D9C000-memory.dmp

          Filesize

          240KB

        • memory/2712-15-0x0000000001360000-0x0000000001460000-memory.dmp

          Filesize

          1024KB

        • memory/4076-88-0x0000000073200000-0x0000000074353000-memory.dmp

          Filesize

          17.3MB

        • memory/5032-50-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-56-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-31-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-32-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-34-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-33-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-36-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-38-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-30-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-29-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-40-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-42-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-44-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-46-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-48-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-23-0x0000000002E40000-0x0000000002E7C000-memory.dmp

          Filesize

          240KB

        • memory/5032-52-0x0000000002E40000-0x0000000002E7C000-memory.dmp

          Filesize

          240KB

        • memory/5032-53-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-55-0x0000000010000000-0x0000000010294000-memory.dmp

          Filesize

          2.6MB

        • memory/5032-57-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-59-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-28-0x0000000010000000-0x0000000010294000-memory.dmp

          Filesize

          2.6MB

        • memory/5032-61-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-63-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

          Filesize

          1024KB

        • memory/5032-65-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-67-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-69-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-71-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-73-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-75-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-77-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-79-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-81-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-83-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-84-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-90-0x0000000073200000-0x0000000074353000-memory.dmp

          Filesize

          17.3MB

        • memory/5032-99-0x0000000002840000-0x000000000287E000-memory.dmp

          Filesize

          248KB

        • memory/5032-109-0x0000000073200000-0x0000000074353000-memory.dmp

          Filesize

          17.3MB

        • memory/5032-112-0x0000000073200000-0x0000000074353000-memory.dmp

          Filesize

          17.3MB

        • memory/5032-115-0x0000000073200000-0x0000000074353000-memory.dmp

          Filesize

          17.3MB

        • memory/5032-125-0x0000000073200000-0x0000000074353000-memory.dmp

          Filesize

          17.3MB