034bf70f09517775dec62db553f986991b5117b29f30945b7cbc32603cf45b59

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 22:53

Target

8abdc6665b728e71a0ac1d0418eb441c.exe
Size

47KB
MD5

8abdc6665b728e71a0ac1d0418eb441c
SHA1

abe212e0fba33812ff9da2c1f1362fd2d5a666cd
SHA256

034bf70f09517775dec62db553f986991b5117b29f30945b7cbc32603cf45b59
SHA512

0bf57705cc0fc15ca290d9ee8a0ff0be89b35a8698d100066f5b7bbfebe682e35b97550c1dc5600853a289f1d9d52343d102bf9d67606e0fae1b871265c98752
SSDEEP

768:yCrWu5p9s6/KANRS8xLxzR4rw9ZRdCaAg3S3KnxdqjM4Pl8tgoz:lrWu50W9NRS8nzGs9jdCad3San6jM4ti

Score

7^/10

upx vmprotect

Deletes itself 1 IoCs

pid	Process
2732	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	8abdc6665b728e71a0ac1d0418eb441c.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1936-14-0x0000000000400000-0x0000000000429000-memory.dmp	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/files/0x0007000000017558-10.dat	vmprotect

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zyjunk1.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk2.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk3.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk4.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk.cfg	8abdc6665b728e71a0ac1d0418eb441c.exe
File opened for modification	C:\Windows\SysWOW64\zyjunk1.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk2.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk3.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\zyjunk4.dat	8abdc6665b728e71a0ac1d0418eb441c.exe
File created	C:\Windows\SysWOW64\tkpxrrngi.dll	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1936	8abdc6665b728e71a0ac1d0418eb441c.exe
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1936	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	8abdc6665b728e71a0ac1d0418eb441c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2732	1936	8abdc6665b728e71a0ac1d0418eb441c.exe	28
PID 1936 wrote to memory of 2732	1936	8abdc6665b728e71a0ac1d0418eb441c.exe	28
PID 1936 wrote to memory of 2732	1936	8abdc6665b728e71a0ac1d0418eb441c.exe	28
PID 1936 wrote to memory of 2732	1936	8abdc6665b728e71a0ac1d0418eb441c.exe	28

C:\Users\Admin\AppData\Local\Temp\8abdc6665b728e71a0ac1d0418eb441c.exe
"C:\Users\Admin\AppData\Local\Temp\8abdc6665b728e71a0ac1d0418eb441c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8ABDC6~1.EXE
  2⤵
  - Deletes itself
  PID:2732

\Windows\SysWOW64\tkpxrrngi.dll

Filesize
60KB

MD5
cc3d410c4c58a42544e4605e61e7678c

SHA1
fe8d68024efeb35fa1b1433f51cc00ee3f300f7d

SHA256
50f7c2fa85b942d7331fee82e8e9c926f093cc81aef308550e9cf840e63e0323

SHA512
0dd7bef037f599e749041d18ce06b275358e4b8682979434c268dc1073ef46d31203e63409e5073a56aeb37f32db3d07507cd99a53857106fb0c2dbcbc1c97bc

Download Submit
memory/1936-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1936-12-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1936-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download