Analysis

  • max time kernel
    118s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 10:01

General

  • Target

    992216b5af8c928d1e2cf4b1c94595a2.exe

  • Size

    157KB

  • MD5

    992216b5af8c928d1e2cf4b1c94595a2

  • SHA1

    aa81a072b639be776170cb28f0d4c5f826c8a3dd

  • SHA256

    8ca085425f4a95646ed40fafe6ddf7e6a9d83306f5ce94fdfdf612ff0e1cdc29

  • SHA512

    3c8138744fe6244ed12de058583ad2935b92dccc9ca66a075c093d17ee08d7fce6451d5b7294850c5707daaaa94445324ce618bb03150309b77ff9ba1ec50c08

  • SSDEEP

    3072:UtzFZdNMB6+7PmCuW5HbfyfC/lSIJ2UbGsSAIySL6zuk:KBizqWZ6fC9SIAUb/q3L6q

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\992216b5af8c928d1e2cf4b1c94595a2.exe
    "C:\Users\Admin\AppData\Local\Temp\992216b5af8c928d1e2cf4b1c94595a2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\992216b5af8c928d1e2cf4b1c94595a2.exe
      "C:\Users\Admin\AppData\Local\Temp\992216b5af8c928d1e2cf4b1c94595a2.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    431c65adbb448bb41d162b14a45e3a2d

    SHA1

    de8769322e5a5f8cfe069c44dc10eef1c1f7f0d2

    SHA256

    55e1dbcdd30f5d42857e99bc4bd60c9e1221dfebddbd88700bb20b95b3051560

    SHA512

    41a7da39a3be0e894fe0ca9a9592bd25323ed3b8abaa3f07935a52fafcb87624083b7cf2a405abd785d0c819e25287866b2298e066cc682f9bd754137bd797b5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    efaad50087f71cd1eedbd753eeef561d

    SHA1

    5351c3133b0416d6d87552ad2677236bda97e949

    SHA256

    3482f368cc2a3434525b049f0c8b554fd0a407a1011418e4759218684650696d

    SHA512

    d2a82f1a4f71616083f4b23c9e5f577f19f8d05766362bf9a8074fa983d1cc45107c6efe3cbb1cfb3a4d9486f0b24750f5863cd65ed05185b9ccb86477c5985a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    090dffc9e6b997fc594ad07a3d1e21c4

    SHA1

    9fb218b335a3f4ce0ff847efa38e0e3878e13f5f

    SHA256

    f91c834a1a6c843fbb4836501525e4c8d0e9a7c9ec09692ef8e52368b6da448e

    SHA512

    3b2b8430465c9d12299e7cd5ae1221b6a36657abf7bda8ecce521ec067828f5ff9487b774fe1cfae7f3086d9c612c0556e5ca3cda1efa4c45d0a46e32aeb6851

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2868c2bf16db64077c54706eaca457e3

    SHA1

    5e7cc845d99fe634c12f7ae08b1872772168b351

    SHA256

    485509880018c9bc2bf897233397988ca278af1a269c5e002717531c50449aa8

    SHA512

    773a9ecf62bab51e25da817c0707f9ca5a7b763a4cb3ad420558177ccd1749da2d9ab2fe5e7198585411c9b87e3ac4b1e9a8f2f75fd07c031cfacfe7b0aae74c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    18fad394aca9d2982a28ca94a9ad39c8

    SHA1

    3b38f6484fe4a87baf659981d75ee5c304cc0ead

    SHA256

    ff83756acc6514a694e7609fb93b1def05c2245bfc53af8e30b87f9e93bdf1b6

    SHA512

    8f239360813d2b6140ccba470b75f8acfa40120bbbf88260f59ec1952481bd78425fe93df384b8b086b3fac0dac5c7efd56afa9f9c39718fdf41a6e9e471028a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b48d793affe48e9f2d4dd0dad28d5e38

    SHA1

    01e67db6d3eb18a3a26b3e5399296de91c9d989a

    SHA256

    2d193559f9605c9cb3e7cb5eb016334e52d089f11e756ec2b741c4b6e3db5e5c

    SHA512

    2568c6e00e71bee976a46eacdf19f5741fbe36ed616f6203736643d576fb81d122114699df42d301cb078851d0ed8287f802b7dc89b4c6f8e13b58b5f564a41f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f0230108c8ca86c01b0745314c32ffa0

    SHA1

    7d0f8da8a50b8252576583fc8b95b4b018c16b96

    SHA256

    3303cb34a36aac628be68016e9aafcab27a420ede0ed16a8ac6ef0186d1f05cb

    SHA512

    eadae1a6993a92e998282a521d7a2022a447a1d646f5d5c2def9d6f0166a948a2d186223eff5379adccea8b3e54a76ba3fb9612a179fb2ab3a67211a8d0ecbab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c612b4ad3db3db84e2dd25019035369e

    SHA1

    5713ab7cd6ba4a84f917daf3ee062aa8940d6464

    SHA256

    c3501ab6c1b6070f2b2b4e141c760b6bcd6b6dc31612d0f99456c60e91813615

    SHA512

    05215b0168e56e90cee9ce0436e2ff476193dca0f5aebf8506604751f30c037def7fda3c5ac79f464d72f37eae79e42b25da22841d1d4999b50a3f7eb149cee1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    858639130c4143a705ee4decda5d45fa

    SHA1

    96c9ccf71c18d7a6ffd478ce5eead693027f8e94

    SHA256

    262c7519e763c354e94e53ed1d02a61907887045f5bc3a5b5aa8cfe96c8d03ed

    SHA512

    afc5f71177e37988fa38e054fc616bfe3946d63784d40a9e32e064f4f94e0c9839d6045bf74dbd280d952cf46cf8c0812ed41d55d18b32bea503df673138b987

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4d4415a6c713da370e52e208dd60ab1d

    SHA1

    bd84736f386881bb31dd65242929cd080604840e

    SHA256

    69876dc8c2f33f5bedf9f0f219840e4239a5ccb93969ed0226797d19cb10e5c1

    SHA512

    d226182a2426cf78944de6c3149511f9921fa8edceaf074077d727adba503a2d5597ff4a0ea12f015106b61f3a9a4e53d3be44f860bf041b3faf2724fc12fd2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    73827d13a0f65573f155269ee7c86150

    SHA1

    d10c40fe66ea5fe0d9b912d4336df12fa7f908bd

    SHA256

    e5edbb14057fffd01c98f2a19f2e7ff3a260eb0c431561ab967b9afa693dfbb8

    SHA512

    cc064b8ea6915ed48b1458c05d97dddec8a597abf1fd74950a8c771d205c983ae607fdb6056b3b9029740579b8ea13a74940ac3b1e90bf466fa215ae2e18ef87

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    da4b9b05762222ea114b516a2ff41397

    SHA1

    528d65deafaf617e29d328a5c52905f2e3abeaea

    SHA256

    c2c34a8ffce2f59f27ac672466a48555006880806368df9c5ca9d7d0d49508d0

    SHA512

    dce6cf934375e36658c03266e58f7f701066145e835e99e2e11a617d2afc807903ba83ee5a8dfa08579085cc5a107352b78372b40c26173a11a70276634ef56f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ba9f0c5565134d0e70ed7005251ab392

    SHA1

    10d8adebfcba1c69c770c1492a7ac5d36bd6812d

    SHA256

    67d73fe7b3bf54b3f7489ce2a572d55ebdf75ed61e67f9802424bafe2aecc96a

    SHA512

    de5f28022029ea58ecc3e5d6ec5832a25054816137b7eab8ef4e00ca71c7d34fa2802b5782ea9fa3c9a0d3c639e200ab23625dcf584e7792f1f7e57a586deac9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    67631471e45ebc40f0e71a2e47555f52

    SHA1

    cf5a0fc35f656d9a6e56833c806cfa5d6505c170

    SHA256

    50447b5b13d9ef2cde50d6cbd4ff0fce0d79385bb9d255d5aa85d53d2ea0fcd9

    SHA512

    55d058c5d5c8daba47a6e210b091f7a3293802a8f81404a6407d86959535f91fc740877b47b143e5605d86b002dd1c624a7051debcd3a595390a02901c016916

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a35e3a4bbbe090d9ffeb8b1de0bebdcc

    SHA1

    9170975c6b9da5473c7c7c0fdaea9e5d6756c6e9

    SHA256

    4ad8762e7ee13e6726cda5504b6b69105fb099392863dd259cbe3af93f48841f

    SHA512

    980f74a12606d89f5bcfd6253acd4e52952eb64ad44148d099b8fff3094fbeb73d0dca1b6c10f45d97681063a822fa60ce8553cd749c33462a859af83b092ffe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    08679c73e4ddc4a766275efd0249501b

    SHA1

    be7802625794effbba6b1c1adf587b74a01fbd08

    SHA256

    7b556d9d31f2f5386373c4998ce73c1710158a22b4f0cfdf65b2c2e6d4ca1131

    SHA512

    aa821a755a88652dc36fc20d79c30f8fafaad9afbd944c3880dcec018234b117e5cfc3fbe60e1204bbc6f56f70ef8313078ddfdd57605422cdfaa2118a09e4dc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4bfd06fe1a21b4de108c5dafa58cd556

    SHA1

    bc7532091e35daafc1563213c3850cddb23c3cc3

    SHA256

    a6fc10ef7d0889142f20007143de160fa4b6d2fa843b90867eaf6fa440fd8a5a

    SHA512

    f92cb523567e8572030766f0c279038b0a167c1eb041bc1f8de3c4e1bad5a4af7f75841029e3b898bd902eaddc9cd20023ef27aafba2f45273adfd50528ad76e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    81d4108bf77dff5ddaa3d47a8552eb55

    SHA1

    976108746665ce66ba64fed4f859ed4fde26991d

    SHA256

    2bc68cc6ae9554021dd4b9f7e0383cbda88159e52d352d093d656e5c5b0f14a9

    SHA512

    1f0c2638c65f7d9ffbe77cd5f96ddd3c9451910f08dba17bdaa57ca33844e661001151a5429b4c2cc368280ecb6d32bf5a674575487caa862e0be871dcc6386a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    53e767fead3e1bd2d8a6ba686012b1fc

    SHA1

    375f83a89071bf6031d4155e8f0363cbbce66bb5

    SHA256

    363ee68b9476dc749064af643b90e5faf8d4e20289b67f5f75215731285e80c4

    SHA512

    4447a44eb2fe6d3918385840cce1e9020f6f3248b5e7bada11eefcc17a27582582c4e4568fea8bffcbe3cd95cd508f72125b04730dc7899adf0899e595c2d52a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    5670e4e2e12b7bf0154c9ff75f2653ec

    SHA1

    4868e2a7b565239bfe2d5620b16469482241c9aa

    SHA256

    4aaca39b49d3420b844acfb0b8f758560273db927005f022876aa3f2c1d9eb85

    SHA512

    dafd103738e6a5cd48e2a89e0ee7463a1f761373df3a620f0cc833ffcc4339ce499e8fc98c16d307dda56c9781669d2823d1870acfef83ca96c1463515304beb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

    Filesize

    4KB

    MD5

    da597791be3b6e732f0bc8b20e38ee62

    SHA1

    1125c45d285c360542027d7554a5c442288974de

    SHA256

    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

    SHA512

    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

  • C:\Users\Admin\AppData\Local\Temp\Tar4724.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1028-18-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-15-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-25-0x00000000004D0000-0x000000000051E000-memory.dmp

    Filesize

    312KB

  • memory/1028-21-0x0000000000470000-0x0000000000471000-memory.dmp

    Filesize

    4KB

  • memory/1028-20-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-3-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-26-0x00000000004D0000-0x000000000051E000-memory.dmp

    Filesize

    312KB

  • memory/1028-19-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-5-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-27-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1028-11-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-9-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1028-7-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2340-17-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2340-1-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB