Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    18/11/2023, 12:02

General

  • Target

    c3ee1f6b785e70514b4110f4605a392418a4e39028859a59b192fa0e452fb9ef.exe

  • Size

    8.3MB

  • MD5

    8aa7fcc1c2a59b04fe2d6be97bfec658

  • SHA1

    dd9081737fef12d2cffd6bf25acc24842b5d1f27

  • SHA256

    c3ee1f6b785e70514b4110f4605a392418a4e39028859a59b192fa0e452fb9ef

  • SHA512

    4f72e35d5c8288f4c0ddbf917bfa53836d4c494118b2f2d19322706c9d11c5a98f4364bb31ced874487f549dfd8cc359e2bd6160f4311455fffec0685d9460c4

  • SSDEEP

    98304:PAWGAMxlUOYqdwkLcHHvkvc8veTP+hU7oiOcQ1GwvZGVrlyKGxQVVzArOSqeDalu:PZOSOjAE9vjKGxQrc9BDalu

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3ee1f6b785e70514b4110f4605a392418a4e39028859a59b192fa0e452fb9ef.exe
    "C:\Users\Admin\AppData\Local\Temp\c3ee1f6b785e70514b4110f4605a392418a4e39028859a59b192fa0e452fb9ef.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e352ed275f3fcfda4657adae5569d1a8

    SHA1

    620c738924ac14cd9872ce12248a9785a0b7fe1b

    SHA256

    18712833f617fa7ce8a63991357a49b043b5d936f2c0cf01fc5aaddf8f7cf5d4

    SHA512

    fb5f006fe288adaff5d363f2481f3ef1781fb7106d23eb134fbc2685090cfb47de587c97b2790631376287eea129e0caa858a659751b067ecbdf572359b52e3f

  • C:\Users\Admin\AppData\Local\Temp\Cab8671.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar871F.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • \Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

    Filesize

    8.4MB

    MD5

    8b6c94bbdbfb213e94a5dcb4fac28ce3

    SHA1

    b56102ca4f03556f387f8b30e2b404efabe0cb65

    SHA256

    982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53

    SHA512

    9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a

  • \Users\Admin\AppData\Local\Temp\SkinH_EL.dll

    Filesize

    86KB

    MD5

    147127382e001f495d1842ee7a9e7912

    SHA1

    92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

    SHA256

    edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

    SHA512

    97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

  • \Users\Admin\AppData\Local\Temp\libcurl.dll

    Filesize

    2.5MB

    MD5

    298f5812023bab65ee23d13ee9489a6e

    SHA1

    71e9d7f205e5e7af6907c539c77a3aeea971692f

    SHA256

    fe100d35b034c15ae3b74379f4eedd321c8e4b84fe666b54ee924ca2a8bdca6e

    SHA512

    217258fb7728f61199f913fb98c894077c12a124e1596d1c6c7cfc065d4d2a6e1e03ad950c3321e2a8dcd997fb5c9524f98530db4bcb39f9914ecb5ff0e22dbd

  • memory/1192-11-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/1192-13-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/1192-14-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB