9af0b17db1b1e27fc565f7a6540561497b9f21f1cd2f1e2c2410def14ece1291

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60a0b246605b6f0663b4c1fa0ce7b36c.exe
Size

4.2MB
MD5

60a0b246605b6f0663b4c1fa0ce7b36c
SHA1

e7a2b55bf559f5a03fab66550672e94f634e5a5f
SHA256

9af0b17db1b1e27fc565f7a6540561497b9f21f1cd2f1e2c2410def14ece1291
SHA512

1ae3c6326630f15fbf71f262cce529456c3e57ea5989e48a7c36265f28542fc393420237bf61ab9bf5128496fa81288a91e4fc87f9c5cf91dba3c38642f199d2
SSDEEP

98304:KEB5hYqGIAzAIfW4ria7+/zqitNiN09x90NVFNI9+625G5XxKlf1:dJGrGzLNeIx9MFNIs625G5XCf1

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0038000000014713-10.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3056	60a0b246605b6f0663b4c1fa0ce7b36c.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x0000000000564000-memory.dmp	upx
behavioral1/memory/3056-12-0x0000000003FD0000-0x000000000402B000-memory.dmp	upx
behavioral1/files/0x0038000000014713-10.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	60a0b246605b6f0663b4c1fa0ce7b36c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3056	60a0b246605b6f0663b4c1fa0ce7b36c.exe
3056	60a0b246605b6f0663b4c1fa0ce7b36c.exe
3056	60a0b246605b6f0663b4c1fa0ce7b36c.exe

C:\Users\Admin\AppData\Local\Temp\60a0b246605b6f0663b4c1fa0ce7b36c.exe
"C:\Users\Admin\AppData\Local\Temp\60a0b246605b6f0663b4c1fa0ce7b36c.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~zm_{E6BB443D-C8EA-45DA-AFF7-C9CEE7A30BAA}\page.html

Filesize
1KB

MD5
f53c74115af3730f902ee47a7639a53c

SHA1
166820ff9ff7d5383a06f001a9c1ff3b400b9f93

SHA256
ccafdd53d3af9fa1bb36a654b6992571d4c3899892f3353e6bfb2a8e3fa4cdc5

SHA512
b83b91721411b43eedc78e05f0ed9b98aa2f55c2ef6bd4067c6bf5839567eeba0af82560e8886b44bb80e3e23c067beb0e196ca12707f6324492874ed1f88160

Download Submit
\Users\Admin\AppData\Local\Temp\{8957B89B-E48A-4971-9358-15734121C972}.dll

Filesize
92KB

MD5
b0d82b948f29b48adc333b1ea5fd2b14

SHA1
171ababf31398bccd92d5de87242dc7a1afcd16e

SHA256
9fb3fdda81278fff64338af689994e48303f29381098bfbd949a772b8bb94cf4

SHA512
860153b9fb7098233e35ed2dddda61b7cf9fab68f026671bdd6385a3460161a31ce043e09dba5206ca651969afdd22aea8c1d97000c23cd0390c29b34e9023bf

Download Submit
memory/3056-1-0x0000000000230000-0x0000000000237000-memory.dmp

Filesize
28KB

Download
memory/3056-0-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/3056-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3056-2-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/3056-12-0x0000000003FD0000-0x000000000402B000-memory.dmp

Filesize
364KB

Download
memory/3056-73-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/3056-75-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/3056-76-0x0000000003FD0000-0x000000000402B000-memory.dmp

Filesize
364KB

Download