Analysis

  • max time kernel
    26s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2024, 20:30

General

  • Target

    f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe

  • Size

    1.9MB

  • MD5

    0c575308d12c2194af27612e8b97a57e

  • SHA1

    8e8a8898fdca9b49fcaae1a9870eaac49cee8c3a

  • SHA256

    f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445

  • SHA512

    8f5baf02016305c351c84adccd02dbe987e7707735f2fe54b6a3cb3dbc847c34fd572923dc308e16d9388eb564bc15c0c6aa66e662b6697df86c7e6658720959

  • SSDEEP

    49152:e5At40lo54psW/WsdiyNIPVSIpgmTPkvFZV:e5MTC5Sv/WsgyC9/gdb

Score
7/10

Malware Config

Signatures

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe
    "C:\Users\Admin\AppData\Local\Temp\f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.x5ch.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:2
        3⤵
          PID:2480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

      Filesize

      1KB

      MD5

      3fb6b48b879b0f65f10810fd1995c08d

      SHA1

      8c06e78fa660066dfb68e8c8989cae3f6cdefcaf

      SHA256

      bbde0417d7cc3e5145a5701df36bb6d748c8d13aa40a48b38cbd71ec9a27373a

      SHA512

      cd2f75a7fc5adacc6bbc08155a1c12644d7fd356d32a36398fb53258107b42e66acb7dfdb3995584294205325ddad7c79c9409cddc077e73a349414bb57da0eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      92eabd6b334f0a8c9862af44eaaa85eb

      SHA1

      520f0e4afd991611f3c9259394dfbacf17d1e937

      SHA256

      c365ea3020b17d38a0f105047c95fc0e3a7e73f67e01c9c9b79c01c0aee6b945

      SHA512

      a22bae6716396498f0135e85ee9a33023aaef08d7318b3c994531ee5fe886ccae958e14152585f7b7f725c0edfc006a8c66107cc6e896c7d59a93b1eaa156b3b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c32a2cad067c018bc3a6d7c09fd73045

      SHA1

      ded3ddaa6270ac3d49fdfc7a82268ce6e1418c03

      SHA256

      6313703ab87684924c285ff5f9ea69137279a22b4921201c16d8ecfb46c3a09d

      SHA512

      d2bd3eff38eb24490c65d5bebd367664863fb4ed50dfd0d7c37feb0453fbbda30a935e8ef503ffcc26bea2ad64a1418690d87f8fefaa95f5df5e228b3e21d35f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      18f06c5d0abe6e63029ff843db682b68

      SHA1

      bb5d1f737a4148dc6a2c2b5a79e701235ff4891d

      SHA256

      7c29517e1916917f726aa9fa2dc4d576b4a8222dc866483142ed0053b7fdb254

      SHA512

      206fc0681ab7783b38996bf5d46cc9f70969cad92d78c8b20d643539539f2d0f46f1f082c24d8f6a43e730a06aca36cf77264baf9c370db70a0579c7ebcb800b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3de8c72960aec529bc7c539942682b6a

      SHA1

      3088204ae7ad15e7e2f6f03fbffa606219d414c1

      SHA256

      c17d386c4c7bf6d22e3930f5e4798349c500767e69b6fecc03d970d8da7c3696

      SHA512

      52286c79f8b6f2e53534a76a5285033705bc04f5c3a203255c35eaa033f0af50b50704a6482bb9bd0661fd92f44a8a7c8e4c003a1733ab5da158ce301bceed48

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      391513307002f407ce826891c147c181

      SHA1

      52e2a8845de957d0b9e361e53d7df48fd211b18a

      SHA256

      4597a8074b565c03311d5c31423f589c2757e0e7f7dd9f27abe0faddef2c3b5e

      SHA512

      4deb0fdf9a921748761c63f2b8a99b914f12d254570b7510b0eb4b0ef7a71f1f5e67f27bab405909acf191060db55072df7459efc3b2bf75111da86a95d7e62e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      58fbbfaadb2452d3a0886e7c317b42fe

      SHA1

      aa04ce333d56355c3ee453e6eaabf612a68e0fbf

      SHA256

      c8063a3ad0b262568592b014547f2c709eef6848f6bf6fd02fb27f7390bffb14

      SHA512

      59d00f44f2ffd1117e68a96ec6532b6952a5d731e324e9a0789134ceb69807e1b5ac00e6e9c544cd9f7dd65e18e5339c5f0ae01614ac994be4ee4e4fd839e087

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7fabff5e2c4deb9d59c227b24f142dd7

      SHA1

      4c1a0584f7a7ce253295b2ff5fb2701e8f78a4e3

      SHA256

      b171981701e030699bf0672529e653f61cf3094863c513761e560da996478e6d

      SHA512

      6a7ed06d21fad91952f98a34afc6c54fd337c2d88db3bbe3ef7c76efc2392b5beead1abfc2e96daa2484f45819e66fb5bfb1e2af3fe16a38713786ebbf9324a5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      01cd561a48283d13443da72864c5c1c2

      SHA1

      3ab07254904a3e24648772f306017071a59016bd

      SHA256

      58c957b55319bc695ba4b3ed478c28d8b49f26625bbc19e6f142592a83a40f0b

      SHA512

      fd3e3888150b640bdd2e9fa24659b11c5f5300e047771ecd55022c0a1556e1d2af4d1e79ef4fc17ccac9b4d68882aad41733a13c3d9f9812ea9b8d6864d1977f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e9dccd3339864f880b9c0123dd574b9e

      SHA1

      bd7beb5433afbf0a3be1283cc07c82d36218f18d

      SHA256

      136d515e228e720c5f44ab5f792641e62d013c38ebe9dab41ed647bf3e61db53

      SHA512

      db0a5539c7a757ef9356096809a539517a279d9f08b53e7012c70d50e2ea8d285d07a4274155a1ffb76d226415a342a8dc683865bde00f9280deeffabe27ac02

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f564d9802ff8f011685993501da8a18d

      SHA1

      77d00ea96983c53705cf22da23cbb68baf1aed67

      SHA256

      859fb2998c180fa8117a714c79699c3caf729e1d1c9da6bf2e9c8c1430f40974

      SHA512

      0a94f5d52c41b36c812d5f131eddd6bdebb36c65eccd14ae6266708dd267aaae246ce1033f9853bc49baaab33825025354715cd3e48bf00b3bf3d847dbd7542c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ec6111974f8e205748a1aed2c986a014

      SHA1

      645fa97b1f20d53ad27c0b365240427eee73f1e8

      SHA256

      d13b7f3a6b13e79961262c9e825db523f4f1c063bc7e6b1f059ad6e928968adb

      SHA512

      8d0d63e20da6953f343a005f47353eba9c6f81cafac89c7f09910e7e7c738df9cc3ac88d8e96516e7cecf0c82f1aa7f6ee923c841a729b22028a40fb47af45e7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5d6c7a950eabe0bbb3c885d42d554cea

      SHA1

      98976f6aa8d1dff71c955ab9ab2d36cb1c828808

      SHA256

      c25a65b9b226d26da2313cc5a65f6e3b7ed91a04c08a574e3892a44e4c3d3cec

      SHA512

      7c908fda4a991c97b65ca95250e40e0b5df74d7a0bc48107654360fec3b4167844880f025a0c2958fb0c2bf8ad392bc3f5c10d4a3c62986afa8f6765cb3461ed

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\SPK[1].js

      Filesize

      2KB

      MD5

      33e258f8f03b52d7b1b8c355f5c9a35d

      SHA1

      f6e9539620e992f92c702c052eaa75cd79716f6d

      SHA256

      014a45a8f8534fa77ffeb98a54af1ad284136f0b3a0028e9cbd04c0189fb47fc

      SHA512

      3716826a530d3f2d9de8c7a1274d709811002fee940e8eda8c3f230ead33a03fc721f855219c52127afbf5c7323d24c418ad14f4f815ded16593fe096d75141c

    • C:\Users\Admin\AppData\Local\Temp\Cab8BCC.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar8CAB.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • memory/1716-43-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-62-0x0000000000400000-0x0000000000889000-memory.dmp

      Filesize

      4.5MB

    • memory/1716-29-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-27-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-25-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-23-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-21-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-19-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-17-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-15-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-14-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-11-0x0000000076770000-0x0000000076771000-memory.dmp

      Filesize

      4KB

    • memory/1716-7-0x0000000076770000-0x0000000076771000-memory.dmp

      Filesize

      4KB

    • memory/1716-3-0x00000000779A0000-0x00000000779A1000-memory.dmp

      Filesize

      4KB

    • memory/1716-1-0x00000000779A0000-0x00000000779A1000-memory.dmp

      Filesize

      4KB

    • memory/1716-60-0x0000000000400000-0x0000000000889000-memory.dmp

      Filesize

      4.5MB

    • memory/1716-61-0x00000000779A0000-0x00000000779A1000-memory.dmp

      Filesize

      4KB

    • memory/1716-31-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-35-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-37-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-39-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-41-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-0-0x0000000000400000-0x0000000000889000-memory.dmp

      Filesize

      4.5MB

    • memory/1716-48-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-50-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-53-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-55-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-58-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-59-0x00000000023B0000-0x0000000002433000-memory.dmp

      Filesize

      524KB

    • memory/1716-57-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-46-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-33-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-13-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1716-9-0x0000000000400000-0x0000000000889000-memory.dmp

      Filesize

      4.5MB