57c9ccf5d6bfbac4b9a455f8d0b0183ed1581f38088b1f8cdb91e41986e80406

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6e38d791e02945b8b41ca748d81f2f1.exe
Size

1.2MB
MD5

f6e38d791e02945b8b41ca748d81f2f1
SHA1

921e80ea398fd763a04f5755eb52a246fb3dab49
SHA256

57c9ccf5d6bfbac4b9a455f8d0b0183ed1581f38088b1f8cdb91e41986e80406
SHA512

240784d2ef74941ecb50efa874429dbdf78b31e3eecd0db5ed1b3a358b5225aa2a5d107ec6e4ca92336fd27b88c542a8d35e3187c6313c8b06150b40fca917d6
SSDEEP

24576:gz5px7lbeJfYVcisyzErAjehjV6KLbS0PdL2Gwk0s0nQT:gz5pJl/rz/jeZVFbTdL/N050

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a0000000126af-12.dat	acprotect

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f6e38d791e02945b8b41ca748d81f2f1.exe

Loads dropped DLL 1 IoCs

pid	Process
2940	f6e38d791e02945b8b41ca748d81f2f1.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2940-19-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2940-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2940-17-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2940-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/files/0x000a0000000126af-12.dat	upx

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2940	f6e38d791e02945b8b41ca748d81f2f1.exe
2940	f6e38d791e02945b8b41ca748d81f2f1.exe
2940	f6e38d791e02945b8b41ca748d81f2f1.exe

C:\Users\Admin\AppData\Local\Temp\f6e38d791e02945b8b41ca748d81f2f1.exe
"C:\Users\Admin\AppData\Local\Temp\f6e38d791e02945b8b41ca748d81f2f1.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/2940-23-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2940-17-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2940-9-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2940-19-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2940-0-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2940-3-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2940-4-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-6-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-2-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-1-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/2940-24-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download