53b53d2f32ab95be7a05c767471024cddc994dcd544c660fbac8063504841d4e

General

Target

10c60b42707b709192b10d963a19c6a1.exe
Size

5.2MB
MD5

10c60b42707b709192b10d963a19c6a1
SHA1

5348a2fc4d5292942f4676d0e983579f5b1c71e9
SHA256

53b53d2f32ab95be7a05c767471024cddc994dcd544c660fbac8063504841d4e
SHA512

9c40f0ad44553e7e5f8708913a5b7c5f5c130687f4985a928f5e33c8255504f4fb0694e98631fb793e477b5d80071c9e7986b0bfa0a823647c3a4508b4e375a8
SSDEEP

98304:PuF6ijSedheAclznDx0NkdsXNB12L79wp9npmMiK0L9jOlWXQTdFK:P1ixdijDc8sbq6vmamwLO

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000016cf2-10.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1620	10c60b42707b709192b10d963a19c6a1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000400000-0x0000000000569000-memory.dmp	upx
behavioral1/memory/1620-12-0x0000000003CE0000-0x0000000003D3B000-memory.dmp	upx
behavioral1/files/0x0009000000016cf2-10.dat	upx
behavioral1/memory/1620-125-0x0000000003CE0000-0x0000000003D3B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	10c60b42707b709192b10d963a19c6a1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1620	10c60b42707b709192b10d963a19c6a1.exe
1620	10c60b42707b709192b10d963a19c6a1.exe
1620	10c60b42707b709192b10d963a19c6a1.exe

C:\Users\Admin\AppData\Local\Temp\10c60b42707b709192b10d963a19c6a1.exe
"C:\Users\Admin\AppData\Local\Temp\10c60b42707b709192b10d963a19c6a1.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~zm_{BDF3D7BC-EDC1-4EE1-92C7-BD0E7C5F8204}\css\style.css

Filesize
1KB

MD5
5b988eba5206504a7a9ef9567a71d576

SHA1
016139e5b3e8dbe79c0d8df6c94329f1f51dd8b8

SHA256
7eb7963147385f4dc813c02fc0109e9fc5525b4021eb6cf2f1402bdf4c0f4b31

SHA512
8154a5101f4360686c405a636037c724b55affcc31e3ff6f3a78c24e77c2816732ef1732c565cf34a41fa78523a4c3738d06c11e3454b21986126630f5c9dd47

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{BDF3D7BC-EDC1-4EE1-92C7-BD0E7C5F8204}\index.html

Filesize
1KB

MD5
0a67859cdbbd7dd49cd5cfff049403e0

SHA1
adace2f52d9aa1de1ffcc115639b7ab6bc35e4bc

SHA256
2e57a485465414f6ba3efd0d61c23a73adef495984e4a8a8dc38785f800efab7

SHA512
73bc711fa0cc7bbd3d17ccf2dcd2eb16b46ca75b793e268028638660ad89dfddcc5d628a426c0e1fe1d66ade5f86ce95f3cbebb111a8e7448af77025c042d7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{BDF3D7BC-EDC1-4EE1-92C7-BD0E7C5F8204}\js\common.js

Filesize
102B

MD5
fd7b0ad90e04f867f0caf572d03b6d1c

SHA1
f54f16fcb066d29d280276dd280b7ee7c83a1573

SHA256
c9c9589c41594137ef6f54b394d3495910601e8f0d77f4ba0866b513e84a24e6

SHA512
0215bd6562e26025c3dd0e6d9696a930368a146bd6d9eab8b0b30149ceeb03a8d0f7b8511203f27e3adcfc5affb9ef7ca040659eb670fead4289c233910f553c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{BDF3D7BC-EDC1-4EE1-92C7-BD0E7C5F8204}\js\lang.js

Filesize
632B

MD5
f3ca8504fe38798d402ada65acc0923e

SHA1
8f9930721e2a559be8e4379cb6e9dc9ffd71ef52

SHA256
f4b4d8d4bb78d970a3fcf6dc8ee0353776801ef373b54d839cd8853c1481a378

SHA512
ab1324ec6f5dcd034efadb6eef3224244de5eb328a4c28e4646a7a182d6af2ec60dad50f52b1e8aedbe18e3eb6a03a4705949763746952492e9abb0f9e01bec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{BDF3D7BC-EDC1-4EE1-92C7-BD0E7C5F8204}\js\unitpngfix.js

Filesize
959B

MD5
997b4c4553a419650ec27b7f53cd94ef

SHA1
13a577fe4669412ef3d54bd761ff7878876079c1

SHA256
a044dffe80c9ce80d2364681836b7835fdc1c49f30ba83192231e5089973c9a4

SHA512
5f423448c03f1f79b4cc326125e27e60a57bf54c9c834c6be6b848712a814c71376a2def86bb5bbe20c4856798ee88560222f9ff60a9e81a5ece1110d7ef76c7

Download Submit
\Users\Admin\AppData\Local\Temp\{7021E5AC-C3B8-4AB7-BB70-92A0F69FA65C}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
memory/1620-0-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/1620-12-0x0000000003CE0000-0x0000000003D3B000-memory.dmp

Filesize
364KB

Download
memory/1620-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1620-2-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/1620-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1620-122-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/1620-124-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1620-125-0x0000000003CE0000-0x0000000003D3B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing