248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
Size

9.1MB
MD5

731c33ce4a553729e10de4a4be6facd2
SHA1

dee8bfd8b9832e240eb1b7e0d3e68dee7e1c3fdd
SHA256

248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff
SHA512

f0a39a64f780ca98e672fb54e8241c3b3ef14cc17a03fa777599a4b926f8c947496acfbb1fb902352bb252d7546b4fad5e003c4b2fbec8c4f46ef32990ddb11b
SSDEEP

196608:02Gl8exN3BiJ96i6ZJ8Ldm7EVxLfu+cZ387vzwquh:02GmGRiJ0i6ZJ8J4CLfu+cZuzwquh

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000022e1a-1.dat	acprotect
behavioral2/files/0x0008000000022e1a-7.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2352	gpuz_installer.exe
5044	gpuz_installer.tmp

Loads dropped DLL 2 IoCs

pid	Process
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022e1a-1.dat	upx
behavioral2/memory/2916-5-0x00000000006E0000-0x0000000003049000-memory.dmp	upx
behavioral2/memory/2916-6-0x00000000006E0000-0x0000000003049000-memory.dmp	upx
behavioral2/files/0x0008000000022e1a-7.dat	upx
behavioral2/memory/2916-11-0x00000000006E0000-0x0000000003049000-memory.dmp	upx
behavioral2/memory/2916-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x0006000000022e3c-18.dat	upx
behavioral2/files/0x0006000000022e3d-30.dat	upx
behavioral2/memory/2916-31-0x00000000006E0000-0x0000000003049000-memory.dmp	upx
behavioral2/memory/2916-32-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2916-42-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2916-43-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2916-60-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
Token: SeDebugPrivilege	2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2352	2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe	85
PID 2916 wrote to memory of 2352	2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe	85
PID 2916 wrote to memory of 2352	2916	248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe	85
PID 2352 wrote to memory of 5044	2352	gpuz_installer.exe	87
PID 2352 wrote to memory of 5044	2352	gpuz_installer.exe	87
PID 2352 wrote to memory of 5044	2352	gpuz_installer.exe	87

C:\Users\Admin\AppData\Local\Temp\248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
"C:\Users\Admin\AppData\Local\Temp\248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\is-M9UFM.tmp\gpuz_installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-M9UFM.tmp\gpuz_installer.tmp" /SL5="$70068,721408,721408,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"
    3⤵
    - Executes dropped EXE
    PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp

Filesize
589KB

MD5
88ecea0e77f113ff2b9268d05eaaed51

SHA1
7e2175aa0cd3de8351ad051acf77ac464b6d9308

SHA256
99e0c24ab51a20e0a169f52eb615551f16e03bc3bf84f0af9f9207fac5d6f646

SHA512
43b8a32515dfa84dbcd85d8f292f4e37a170e6dcf4c97289cda8efe2fddcf3fab3753fe27a7d95a9b6510ce6370e26a8f556cd3c826dff093b9ae11edc41d453

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\B229109CB64.tmp

Filesize
9.0MB

MD5
b12cdd70c477e02ee3cf39443b39036d

SHA1
d4c83022ca79a3ec997b007e5875edc120c52498

SHA256
95afbc3d36bed06081000a1596e6c14ea9231eda031b1901fcfcbda09aa6adcf

SHA512
90d6b439de98d3cbd261df1b505a267d63aa5583adb34270a1a92a259054fd74a0954516e97a72b193c7312df39d1867108ad1e825d2af140a0e98581ccd4ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GPU-Z.exe

Filesize
9.0MB

MD5
b12cdd70c477e02ee3cf39443b39036d

SHA1
d4c83022ca79a3ec997b007e5875edc120c52498

SHA256
95afbc3d36bed06081000a1596e6c14ea9231eda031b1901fcfcbda09aa6adcf

SHA512
90d6b439de98d3cbd261df1b505a267d63aa5583adb34270a1a92a259054fd74a0954516e97a72b193c7312df39d1867108ad1e825d2af140a0e98581ccd4ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe

Filesize
1.4MB

MD5
db0fe2fc8b640f81be6103efabb69fc1

SHA1
b8ede445e915c83981ec63b5ba5cf32ec4017f01

SHA256
6cdfac9a6fd83d7a0b652bd8d5a971a753704302e697c3129dcaa5f2de465a44

SHA512
086695eadbc175e1fad454f3aecee927846fc22ad9f99933b89a722e8e48badc1ce0fb77237711aae674086fff0ee9ba875c79c4f67e84800b72723b1426c393

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe

Filesize
1.4MB

MD5
db0fe2fc8b640f81be6103efabb69fc1

SHA1
b8ede445e915c83981ec63b5ba5cf32ec4017f01

SHA256
6cdfac9a6fd83d7a0b652bd8d5a971a753704302e697c3129dcaa5f2de465a44

SHA512
086695eadbc175e1fad454f3aecee927846fc22ad9f99933b89a722e8e48badc1ce0fb77237711aae674086fff0ee9ba875c79c4f67e84800b72723b1426c393

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M9UFM.tmp\gpuz_installer.tmp

Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M9UFM.tmp\gpuz_installer.tmp

Filesize
2.4MB

MD5
8e2d270339dcd0a68fbb2f02a65d45dd

SHA1
bfcdb1f71692020858f96960e432e94a4e70c4a4

SHA256
506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811

SHA512
31eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647

Download Submit
memory/2352-39-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2352-23-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2916-36-0x0000000076AD0000-0x0000000076B33000-memory.dmp

Filesize
396KB

Download
memory/2916-42-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2916-32-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2916-60-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2916-12-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2916-11-0x00000000006E0000-0x0000000003049000-memory.dmp

Filesize
41.4MB

Download
memory/2916-5-0x00000000006E0000-0x0000000003049000-memory.dmp

Filesize
41.4MB

Download
memory/2916-31-0x00000000006E0000-0x0000000003049000-memory.dmp

Filesize
41.4MB

Download
memory/2916-43-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2916-46-0x0000000076AD0000-0x0000000076B33000-memory.dmp

Filesize
396KB

Download
memory/2916-6-0x00000000006E0000-0x0000000003049000-memory.dmp

Filesize
41.4MB

Download
memory/2916-51-0x0000000076AD0000-0x0000000076B33000-memory.dmp

Filesize
396KB

Download
memory/2916-21-0x0000000076AD0000-0x0000000076B33000-memory.dmp

Filesize
396KB

Download
memory/5044-40-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/5044-33-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download