Analysis

  • max time kernel
    145s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2023, 05:40

General

  • Target

    99493be2baf7d5959fd2dd4cd09de139748f38757da814374ca9ced92c3f06a4.exe

  • Size

    6.1MB

  • MD5

    1e35465aa719b0f1b7cc5d3d92d0b6cf

  • SHA1

    d7e07451e9538251b10b6dc86020b1492129bd66

  • SHA256

    99493be2baf7d5959fd2dd4cd09de139748f38757da814374ca9ced92c3f06a4

  • SHA512

    83db00320ca1b95e7cae81647837ec9355e47fa7eefcfdcc4b28a6ac4f0fcb81e5985f12fe14899e0ae2e5c870f5a6dec14e4afe6381b8521fb89def451e40af

  • SSDEEP

    98304:Fum3hYsDXe2lgtnHrkSkMcwfys+QXwn1mwyFXXNDB2RY3hruWTgwHWLarV0TL+:Fu3GOF6XMIEwedD2AJt6/+

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 8 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99493be2baf7d5959fd2dd4cd09de139748f38757da814374ca9ced92c3f06a4.exe
    "C:\Users\Admin\AppData\Local\Temp\99493be2baf7d5959fd2dd4cd09de139748f38757da814374ca9ced92c3f06a4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 c:\¾Õ»¨¸¨Öú\SmIlE.dll -s
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2160
    • C:\Windows\11\AJJS.exe
      C:\Windows\11\AJJS.exe xq AJJS.exe C:\Users\Admin\AppData\Local\Temp\99493be2baf7d5959fd2dd4cd09de139748f38757da814374ca9ced92c3f06a4.exe ÊÖ¶¯
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\11\AJJS.exe

    Filesize

    1.3MB

    MD5

    1fc2eee1d789e4531a7187aa963ac6fc

    SHA1

    e1603d942712e707ef920417579296f0f9a9bf99

    SHA256

    db107d01b1702dc1db6e6af8a9ab871813b9c348c59abefa0ab9963977cd7421

    SHA512

    30b4079d17521e1f2b23cefe928a554583cf52b87594a7c3a7a7c8c3e9178bad78e3821fefb3619b1b3ceb5c7f88c5555ad1d0ce5dba72f718a81bebfcd6233c

  • C:\Windows\11\AJJS.exe

    Filesize

    1.3MB

    MD5

    1fc2eee1d789e4531a7187aa963ac6fc

    SHA1

    e1603d942712e707ef920417579296f0f9a9bf99

    SHA256

    db107d01b1702dc1db6e6af8a9ab871813b9c348c59abefa0ab9963977cd7421

    SHA512

    30b4079d17521e1f2b23cefe928a554583cf52b87594a7c3a7a7c8c3e9178bad78e3821fefb3619b1b3ceb5c7f88c5555ad1d0ce5dba72f718a81bebfcd6233c

  • C:\Windows\11\AJJS.exe

    Filesize

    1.3MB

    MD5

    1fc2eee1d789e4531a7187aa963ac6fc

    SHA1

    e1603d942712e707ef920417579296f0f9a9bf99

    SHA256

    db107d01b1702dc1db6e6af8a9ab871813b9c348c59abefa0ab9963977cd7421

    SHA512

    30b4079d17521e1f2b23cefe928a554583cf52b87594a7c3a7a7c8c3e9178bad78e3821fefb3619b1b3ceb5c7f88c5555ad1d0ce5dba72f718a81bebfcd6233c

  • \??\c:\¾Õ»¨¸¨Öú\Reg.dll

    Filesize

    52KB

    MD5

    732b1be137e2be34507c7f68a54ad4a1

    SHA1

    7fb87f8fb3af946e9a3bc4e08756a7eec89cd27f

    SHA256

    679d0ef74fbf7fab6442968ee1cc7e9b4e2cf1860491a7f83a1a5903516cf2e2

    SHA512

    d39ff43d1cafa56cdfce578c58ae7bb82166c3a44b488c5579588073bba763adeb83137f65ff38c8bc95aae44bf143b4a656651a84de9d5bea59c36606b5b391

  • \??\c:\¾Õ»¨¸¨Öú\SmIlE.dll

    Filesize

    3.4MB

    MD5

    c4a0301bfdca2b60ea34b8e777ef2063

    SHA1

    81faaf396e1d75fb576abf37278d76efaa12947c

    SHA256

    4109a1f49d0d5851f7bb73969c2d9ccd3793814486e084ae8506cc6f2a558c78

    SHA512

    eba5f8684840164929f1575864f7e3f1c85f7b3e6f7ea46ec43634b8f3b5a91a6d3cf4969c77241bf78ed1e3490af3b7cd91b1d910ecf584c5f0e6e5390e19b8

  • \Windows\11\AJJS.exe

    Filesize

    1.3MB

    MD5

    1fc2eee1d789e4531a7187aa963ac6fc

    SHA1

    e1603d942712e707ef920417579296f0f9a9bf99

    SHA256

    db107d01b1702dc1db6e6af8a9ab871813b9c348c59abefa0ab9963977cd7421

    SHA512

    30b4079d17521e1f2b23cefe928a554583cf52b87594a7c3a7a7c8c3e9178bad78e3821fefb3619b1b3ceb5c7f88c5555ad1d0ce5dba72f718a81bebfcd6233c

  • \Windows\11\AJJS.exe

    Filesize

    1.3MB

    MD5

    1fc2eee1d789e4531a7187aa963ac6fc

    SHA1

    e1603d942712e707ef920417579296f0f9a9bf99

    SHA256

    db107d01b1702dc1db6e6af8a9ab871813b9c348c59abefa0ab9963977cd7421

    SHA512

    30b4079d17521e1f2b23cefe928a554583cf52b87594a7c3a7a7c8c3e9178bad78e3821fefb3619b1b3ceb5c7f88c5555ad1d0ce5dba72f718a81bebfcd6233c

  • \¾Õ»¨¸¨Öú\SmIlE.dll

    Filesize

    3.4MB

    MD5

    c4a0301bfdca2b60ea34b8e777ef2063

    SHA1

    81faaf396e1d75fb576abf37278d76efaa12947c

    SHA256

    4109a1f49d0d5851f7bb73969c2d9ccd3793814486e084ae8506cc6f2a558c78

    SHA512

    eba5f8684840164929f1575864f7e3f1c85f7b3e6f7ea46ec43634b8f3b5a91a6d3cf4969c77241bf78ed1e3490af3b7cd91b1d910ecf584c5f0e6e5390e19b8

  • \¾Õ»¨¸¨Öú\SmIlE.dll

    Filesize

    3.4MB

    MD5

    c4a0301bfdca2b60ea34b8e777ef2063

    SHA1

    81faaf396e1d75fb576abf37278d76efaa12947c

    SHA256

    4109a1f49d0d5851f7bb73969c2d9ccd3793814486e084ae8506cc6f2a558c78

    SHA512

    eba5f8684840164929f1575864f7e3f1c85f7b3e6f7ea46ec43634b8f3b5a91a6d3cf4969c77241bf78ed1e3490af3b7cd91b1d910ecf584c5f0e6e5390e19b8

  • \¾Õ»¨¸¨Öú\reg.dll

    Filesize

    52KB

    MD5

    732b1be137e2be34507c7f68a54ad4a1

    SHA1

    7fb87f8fb3af946e9a3bc4e08756a7eec89cd27f

    SHA256

    679d0ef74fbf7fab6442968ee1cc7e9b4e2cf1860491a7f83a1a5903516cf2e2

    SHA512

    d39ff43d1cafa56cdfce578c58ae7bb82166c3a44b488c5579588073bba763adeb83137f65ff38c8bc95aae44bf143b4a656651a84de9d5bea59c36606b5b391

  • memory/2160-5-0x00000000029D0000-0x00000000032CA000-memory.dmp

    Filesize

    9.0MB

  • memory/2160-9-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2160-8-0x00000000029D0000-0x00000000032CA000-memory.dmp

    Filesize

    9.0MB

  • memory/2160-7-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2160-6-0x00000000001B0000-0x00000000001B2000-memory.dmp

    Filesize

    8KB

  • memory/2160-4-0x00000000021B0000-0x00000000029CB000-memory.dmp

    Filesize

    8.1MB

  • memory/2160-3-0x0000000010000000-0x00000000104FC000-memory.dmp

    Filesize

    5.0MB

  • memory/2472-41-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-49-0x00000000020F0000-0x0000000002106000-memory.dmp

    Filesize

    88KB

  • memory/2472-36-0x0000000077E4F000-0x0000000077E50000-memory.dmp

    Filesize

    4KB

  • memory/2472-37-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-39-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-38-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-40-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-32-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-43-0x0000000001F70000-0x0000000001F71000-memory.dmp

    Filesize

    4KB

  • memory/2472-33-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/2472-44-0x0000000004270000-0x000000000476C000-memory.dmp

    Filesize

    5.0MB

  • memory/2472-45-0x0000000004770000-0x0000000004F8B000-memory.dmp

    Filesize

    8.1MB

  • memory/2472-46-0x0000000004F90000-0x000000000588A000-memory.dmp

    Filesize

    9.0MB

  • memory/2472-34-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-48-0x0000000002190000-0x0000000002192000-memory.dmp

    Filesize

    8KB

  • memory/2472-35-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-50-0x0000000004120000-0x0000000004121000-memory.dmp

    Filesize

    4KB

  • memory/2472-51-0x0000000004270000-0x000000000476C000-memory.dmp

    Filesize

    5.0MB

  • memory/2472-52-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-53-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-54-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-55-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-56-0x0000000000190000-0x00000000001A6000-memory.dmp

    Filesize

    88KB

  • memory/2472-57-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-58-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2472-59-0x0000000004770000-0x0000000004F8B000-memory.dmp

    Filesize

    8.1MB

  • memory/2472-60-0x0000000004F90000-0x000000000588A000-memory.dmp

    Filesize

    9.0MB

  • memory/2472-61-0x00000000020F0000-0x0000000002106000-memory.dmp

    Filesize

    88KB

  • memory/2472-67-0x0000000004270000-0x000000000476C000-memory.dmp

    Filesize

    5.0MB

  • memory/2472-69-0x0000000004270000-0x000000000476C000-memory.dmp

    Filesize

    5.0MB

  • memory/2472-73-0x0000000004270000-0x000000000476C000-memory.dmp

    Filesize

    5.0MB