Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 06:05

General

  • Target

    457a65722799fac6bba11e515c45ed05.exe

  • Size

    123KB

  • MD5

    457a65722799fac6bba11e515c45ed05

  • SHA1

    c3f356bd9a0840b430357959a204412fe0ec6117

  • SHA256

    6d07f838f68e3fd0958319878ca69a0648acd010b011e9672e92e75a44d2e9b8

  • SHA512

    7c5ab9d4297aa4627620fc10450b55edde526fb2e5e03be6247cf33782b1a3b3137ad0eca211c762acbd639b52b88caf4c9d59ff594a2ba8aa28ce5544454463

  • SSDEEP

    3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLw:OVYrJrOSsRwcpy

Score
8/10
upx

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\457a65722799fac6bba11e515c45ed05.exe
    "C:\Users\Admin\AppData\Local\Temp\457a65722799fac6bba11e515c45ed05.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\iaccess32.exe
      C:\Windows\iaccess32.exe
      2⤵
      • Manipulates Digital Signatures
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1816
  • C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    PID:2780
  • C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    1⤵
    • Manipulates Digital Signatures
    • Runs regedit.exe
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\iaccess32.exe

    Filesize

    92KB

    MD5

    82d83d4e6dfcf2608cad8e98f94f8c52

    SHA1

    a7eb8b5a73502c3caa521206699dd2ad57599d45

    SHA256

    80211392d91228323fb4cdfe384708629ac2a1c3e80760cb99b4115a9aa61fc5

    SHA512

    1c83e4dd92c0297e9372d7d750a64c3a486ecb0297ae0318c6cdb4da71db953e4180da3837768314c7c36cf2407c031f953ce09a62bff2ca0985fec9d8e88aa4

  • memory/1816-86-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-82-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-93-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-56-0x0000000001EC0000-0x0000000001ED0000-memory.dmp

    Filesize

    64KB

  • memory/1816-92-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-77-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-78-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-79-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-83-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-91-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-81-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-90-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-85-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-89-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-87-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1816-88-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2664-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2664-0-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2664-6-0x0000000001D10000-0x0000000001D3E000-memory.dmp

    Filesize

    184KB

  • memory/2780-80-0x0000000010000000-0x0000000010047000-memory.dmp

    Filesize

    284KB

  • memory/2780-35-0x0000000010000000-0x0000000010047000-memory.dmp

    Filesize

    284KB