9895123405ca6e2cd8ce9e39421d2df0303fd554b8735a523a84b3463bf90a0f

General

Target

fcb256003b504e16ecde1c85cce503a4.exe
Size

6.8MB
MD5

fcb256003b504e16ecde1c85cce503a4
SHA1

1f959e3de91aeb0cac7aa1b36211f354db67db7f
SHA256

9895123405ca6e2cd8ce9e39421d2df0303fd554b8735a523a84b3463bf90a0f
SHA512

c3990f597ade78fd3b17203a60ca1ee71df99af1c1a8822814c57c2ea79e9883e44069272526abcf305cd6b74c0c8dffd8a7a7f469739570293086e207596d45
SSDEEP

98304:SSogif0TdNTVeAIJJKwA8XzQoLYmVh7deYQwcO82ACqWccicTroitI:SSpiMrTVfIcAzzYmb7dXcz3C38QY

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00310000000139be-8.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2912	fcb256003b504e16ecde1c85cce503a4.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00310000000139be-8.dat	upx
behavioral1/memory/2912-23-0x0000000003E00000-0x0000000003E5B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	fcb256003b504e16ecde1c85cce503a4.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2912	fcb256003b504e16ecde1c85cce503a4.exe
2912	fcb256003b504e16ecde1c85cce503a4.exe
2912	fcb256003b504e16ecde1c85cce503a4.exe

C:\Users\Admin\AppData\Local\Temp\fcb256003b504e16ecde1c85cce503a4.exe
"C:\Users\Admin\AppData\Local\Temp\fcb256003b504e16ecde1c85cce503a4.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\css\style.css

Filesize
435B

MD5
084e5106247df179675832e604b6fdb4

SHA1
99251e5d1acea608b5c7b9d4562eafc8aa4d831a

SHA256
c329401e50e3874130637abe653b3956ca9b9c4cb7edfe29940a6d043cd50118

SHA512
872ea0e6a5ba079618b9185e2ac1d8d4a101888aa96545281aaf5c833303ab5b9af7665c9028a62ee5272ad52092ec41668962923abb1ed30efc7a1213939f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\images\clear.gif

Filesize
43B

MD5
9bb191c6827273aa978cab39a3587950

SHA1
25d8043336eb799e52b1a0e15ff6b95e09c24e35

SHA256
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

SHA512
c3970b9a8dc9b424528274e8d22d21e9990ce956aede61cba13de8d7832a8c896eaf1032662a78e95980ea013090cd4406f32604da3c6f557aa136842d04324d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\images\line.gif

Filesize
43B

MD5
edd0fd087a54df4dbcf0afa8e309629f

SHA1
ad944d9989a0dd6fe9f471d511d755b8c53517be

SHA256
0aff2a7ec123f7f837dded84bb0f3ba8f43e39e2298d57d06f8b29eb485a825c

SHA512
a90f00493e3b45bc4d8422164acd7b7ed63bcab533cc5376c1818fd76962e1617e1c8b95dcccfd4492c251ab69d30e3c8d1e38596bc933bc631afdb2981fad0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\images\logo.png

Filesize
20KB

MD5
134176040c6e0a789fb61dfdd79f2d2f

SHA1
1181da826b7988f58d0a864caed407cfe5dfb5bb

SHA256
6d91ae066ade43bb71a66e8904d5ca3e902ef0b8d3064646339c87b54aee63ad

SHA512
1a4c390cfe20169ae3294ac6565bc9d0ac31d2a1ca45c34710b3a1092e321ba201c25826c617f97a8cb8e0775b8bc5c9949ec47492f3c861e813172f8407a553

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\js\lang.js

Filesize
632B

MD5
f3ca8504fe38798d402ada65acc0923e

SHA1
8f9930721e2a559be8e4379cb6e9dc9ffd71ef52

SHA256
f4b4d8d4bb78d970a3fcf6dc8ee0353776801ef373b54d839cd8853c1481a378

SHA512
ab1324ec6f5dcd034efadb6eef3224244de5eb328a4c28e4646a7a182d6af2ec60dad50f52b1e8aedbe18e3eb6a03a4705949763746952492e9abb0f9e01bec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\js\unitpngfix.js

Filesize
959B

MD5
997b4c4553a419650ec27b7f53cd94ef

SHA1
13a577fe4669412ef3d54bd761ff7878876079c1

SHA256
a044dffe80c9ce80d2364681836b7835fdc1c49f30ba83192231e5089973c9a4

SHA512
5f423448c03f1f79b4cc326125e27e60a57bf54c9c834c6be6b848712a814c71376a2def86bb5bbe20c4856798ee88560222f9ff60a9e81a5ece1110d7ef76c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{FED18F66-64E5-4D7B-B27F-4F9EE27E3E51}\page.html

Filesize
1KB

MD5
696920022c71808711e993c884c6e56f

SHA1
f637d0d4b376fb1a15e1eaa68cd826fd99f15243

SHA256
a00265d61e236d844ae4a78104cfaa1a5a8272b0806fadb4a3d5968e8ebd3a5d

SHA512
d7f61b7a0c60a2960bd85ee117c12638b12b56e5982dee9f120ec6b7258025672c459f79e1a2f5dff411e60143f1658033843a44b3938137549cbdec2091736b

Download Submit
\Users\Admin\AppData\Local\Temp\{334FB57E-8B0C-4FC2-BE3B-4DECF7FC3D76}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
memory/2912-2-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x00000000020F0000-0x0000000002206000-memory.dmp

Filesize
1.1MB

Download
memory/2912-4-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2912-23-0x0000000003E00000-0x0000000003E5B000-memory.dmp

Filesize
364KB

Download
memory/2912-3-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/2912-0-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/2912-106-0x0000000000400000-0x000000000057E000-memory.dmp

Filesize
1.5MB

Download
memory/2912-108-0x00000000020F0000-0x0000000002206000-memory.dmp

Filesize
1.1MB

Download
memory/2912-109-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2912-110-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2912-111-0x0000000003E00000-0x0000000003E5B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing