924da949087fcd701ec4155c0d3086a887aec6a2cf976e95f3d7da9959a4dddd

Analysis

max time kernel
167s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d37e3aad1b473b2fd73d01b22460d95.exe
Size

109KB
MD5

1d37e3aad1b473b2fd73d01b22460d95
SHA1

09da146d3f6fd347c12897643825f75dc197f47d
SHA256

924da949087fcd701ec4155c0d3086a887aec6a2cf976e95f3d7da9959a4dddd
SHA512

e1fb992e7b574a1f39ef1a10655c25a938dbb8970fa7f0de41c7eb10124ed494641da1aa0bc25e7d45427530683e7be4936ead0e368640ae564d5ae150d74188
SSDEEP

3072:iuulPCeNv9fls1lCQM0YH5820ZteCYYvJ0SXG5NulkvAs+:2PBZ9fO1lC0ArStNj0SXwLAs

Score

7^/10

adware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000300000001e7eb-8.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
1996	1d37e3aad1b473b2fd73d01b22460d95.exe
1996	1d37e3aad1b473b2fd73d01b22460d95.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1996-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-1-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-2-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-3-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-4-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-5-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/files/0x000300000001e7eb-8.dat	upx
behavioral2/memory/1996-11-0x00000000001C0000-0x00000000001FC000-memory.dmp	upx
behavioral2/memory/1996-13-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-14-0x00000000001C0000-0x00000000001FC000-memory.dmp	upx
behavioral2/memory/1996-16-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/1996-17-0x00000000001C0000-0x00000000001FC000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28165E4A-44F7-498A-9E5D-C32AC9C4F316}	1d37e3aad1b473b2fd73d01b22460d95.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28165E4A-44F7-498A-9E5D-C32AC9C4F316}\InprocServer32	1d37e3aad1b473b2fd73d01b22460d95.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	1d37e3aad1b473b2fd73d01b22460d95.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	1d37e3aad1b473b2fd73d01b22460d95.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28165E4A-44F7-498A-9E5D-C32AC9C4F316}	1d37e3aad1b473b2fd73d01b22460d95.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28165E4A-44F7-498A-9E5D-C32AC9C4F316}\InprocServer32\ = "C:\\Windows\\SysWow64\\agentactivationruntim.dll"	1d37e3aad1b473b2fd73d01b22460d95.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28165E4A-44F7-498A-9E5D-C32AC9C4F316}\InprocServer32\ThreadingModel = "apartment"	1d37e3aad1b473b2fd73d01b22460d95.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	1d37e3aad1b473b2fd73d01b22460d95.exe
1996	1d37e3aad1b473b2fd73d01b22460d95.exe

C:\Users\Admin\AppData\Local\Temp\1d37e3aad1b473b2fd73d01b22460d95.exe
"C:\Users\Admin\AppData\Local\Temp\1d37e3aad1b473b2fd73d01b22460d95.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\agentactivationruntim.dll

Filesize
86KB

MD5
de1030513432661c1944578f910e1646

SHA1
4c997179b3ced957cf3883eb6dc1d84632fec90d

SHA256
23ca50fc4a57a3125c6466e1d6bfbfd52c8b2e47ad951b661215beed3ed2a674

SHA512
97b544949b175fe081fbcaf248fe021eef729ea9eb50fdede467405f87b09b26e96469d4c9079085a3a87a132e4cb77bd886d49a9c9db2bc9fe3f137a47e23e0

Download Submit
memory/1996-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-3-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-11-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/1996-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-14-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/1996-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1996-17-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download