3630567f2673d75d095d3d6f4edd7c69faed7ea7f2e5b68acd95d448dcd244b7

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hypic_setup_trial.exe
Size

1.4MB
MD5

6be5f88cf578325f5baa2f87be05830e
SHA1

9aed285a810b7d8bbb0081251e0b0139dc044c69
SHA256

09487708545b0e31a5148ffcc42acdd36791e26c6d3a582585614892adabcfc9
SHA512

2dfb42a92b9cb5519450844a8cf355e43e4ea83c108f3238aafe4d7d564732f92032c1813f8b85a2cb342cb9c07cf6421f9f917789f2bd70bf77fe8033ee7ece
SSDEEP

24576:9GJXEJhWF6PbmG15DqKR3CDhTDj6L7cFpGmu6tJpZaCXB2mjvy42xExLQbT6zU1n:9RJQF6CGnDJ3EKLgFpGmu67NI6xK6w5b

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2024	hypic_setup_trial.tmp

Loads dropped DLL 3 IoCs

pid	Process
840	hypic_setup_trial.exe
2024	hypic_setup_trial.tmp
2024	hypic_setup_trial.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	hypic_setup_trial.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28
PID 840 wrote to memory of 2024	840	hypic_setup_trial.exe	28

C:\Users\Admin\AppData\Local\Temp\hypic_setup_trial.exe
"C:\Users\Admin\AppData\Local\Temp\hypic_setup_trial.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\is-S1RE6.tmp\hypic_setup_trial.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-S1RE6.tmp\hypic_setup_trial.tmp" /SL5="$70122,1191228,54272,C:\Users\Admin\AppData\Local\Temp\hypic_setup_trial.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-75810.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-S1RE6.tmp\hypic_setup_trial.tmp

Filesize
870KB

MD5
517f4c5ca3e732b3d056c3908770bfa5

SHA1
8150e5bff7e963fdeefa944d8e754819eeae20fc

SHA256
5ace283fc0fd7d58c90e2156d83113c117939bd7ef859bb0d86176fbf6664d1b

SHA512
3cd32e280b01ddd35d74579d1e27ab9afc027d469447fcfa2d1f3b62339af7782a0fad8680be2ee381f867c15af12409748811817a50d767c1a569a645cd8dd0

Download Submit
memory/840-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/840-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/840-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2024-8-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2024-18-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2024-21-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download