Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:48
Behavioral task
behavioral1
Sample
235715797c0c7a4ce26826cb7db56e2c.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
235715797c0c7a4ce26826cb7db56e2c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
235715797c0c7a4ce26826cb7db56e2c.exe
-
Size
470KB
-
MD5
235715797c0c7a4ce26826cb7db56e2c
-
SHA1
502cc77e623a8ce3e241de0a90a3eb3b1bb74039
-
SHA256
46fc41482aef7b563cf8c750e42afdadbc2d532a8181315b769a98af65116e65
-
SHA512
bd13bbde087940125da8d25894cbf99a99b4fce9b0c937249c760113ba6cc40fc5b7d477ebcb04d04e0a2202505b82373e39f2b631cc724dca83ff11092a23ee
-
SSDEEP
1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000a000000017550-6.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 2576 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe" 235715797c0c7a4ce26826cb7db56e2c.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers32\Thief 2 No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Halo Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior 4 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\WinAce 2.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Half-Life 2 No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2002 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Macromedia Flash MX 6.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Microangelo 5.58 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Hex Workshop Hex Editor 4.1 Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Battlefield 1942 - The Road to Rome Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Raven Shield No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\FIFA Soccer 2003 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Midtown Madness 3 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\DOOM III Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Hitman II Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\ACDSee 2.4.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\WindowBlinds 4.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.7.143 Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Rainbow Six 3 - Raven Shield Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\mIRC 6.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\ICUII 5.x.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinAce 2.2 Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\The Sims Superstar Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Warlords IV - Heroes of Etheria Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\NCAA Football 2003 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinAce 2.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Metal Gear Solid 3 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\GetRight 6.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Ulead GIF Animator 5.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Civilization III - Conquest Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Trinity Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Rainbow Six 3 - Raven Shield No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\FIFA Soccer 2004 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Black & White 2 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Paint Shop Pro 8.x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Madden NFL 2003 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\FlashFXP 1.4 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\WinAce 2.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Star Wars - Knights of the Old Republic No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\WindowBlinds 4.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Internet Download Manager 3.15 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\SWiSH 2.0 Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8x Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\NHL 2002 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File created C:\Windows\SysWOW64\drivers32\UltraEdit-32 10.00b Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Xenus No-Cd Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Adobe Acrobat 5.x Crack.exe 235715797c0c7a4ce26826cb7db56e2c.exe File opened for modification C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Serial Generator.exe 235715797c0c7a4ce26826cb7db56e2c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2576 3064 235715797c0c7a4ce26826cb7db56e2c.exe 30 PID 3064 wrote to memory of 2576 3064 235715797c0c7a4ce26826cb7db56e2c.exe 30 PID 3064 wrote to memory of 2576 3064 235715797c0c7a4ce26826cb7db56e2c.exe 30 PID 3064 wrote to memory of 2576 3064 235715797c0c7a4ce26826cb7db56e2c.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\235715797c0c7a4ce26826cb7db56e2c.exe"C:\Users\Admin\AppData\Local\Temp\235715797c0c7a4ce26826cb7db56e2c.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.execmd /c c:\$$$$$.bat2⤵
- Deletes itself
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200B
MD5131db36c42982599fa0f287787efd31c
SHA1b8d12ca73752bd0d30c68bb26c22c96cb96284d9
SHA256d30bf26a3ad108c47d541c76ee4917fe6939e217174e2c4ee582e414d3a5bec3
SHA5129b4aeaf7e0071b7a8063cda59cbe46983cc2431f53c9955abe1a11d02f9d121365f34f50ff5d0728cf85106cb538d745f785f846c6e1b001935fb2df857a2c9a
-
Filesize
470KB
MD5235715797c0c7a4ce26826cb7db56e2c
SHA1502cc77e623a8ce3e241de0a90a3eb3b1bb74039
SHA25646fc41482aef7b563cf8c750e42afdadbc2d532a8181315b769a98af65116e65
SHA512bd13bbde087940125da8d25894cbf99a99b4fce9b0c937249c760113ba6cc40fc5b7d477ebcb04d04e0a2202505b82373e39f2b631cc724dca83ff11092a23ee