27408061ea68acba5b00e2ecbb4108433258ec4d9a52965626783ac8f7a9f586

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

my_sjyc.exe
Size

801KB
MD5

eda6f69c92d53dfa6976c7fd47bdbb72
SHA1

f7a745ad56c50d49733e386cd65fae2d72e8b4b9
SHA256

cb6cf0ad4e2f72014bb0fae29b39b05d6aec46de42a3ee9604148bca1c44b01e
SHA512

314eb8d488214189180d66bba5e763899d1318cca78389a8d8942c4afb992d6e7ff26851fcd3f25734863856e9f2af3e4f17f405fa9b0468c0b25a25cdc6c418
SSDEEP

24576:3Ho4xJ69gKAlpItaejpQZ2+mD2zVsULDCzh6q6jU:Y4sgppIAo2TmD2pFfCz85A

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2116	mfc.exe
2708	my_sjyc.exe

Loads dropped DLL 13 IoCs

pid	Process
3000	my_sjyc.exe
3000	my_sjyc.exe
2116	mfc.exe
2116	mfc.exe
2116	mfc.exe
3000	my_sjyc.exe
2708	my_sjyc.exe
2708	my_sjyc.exe
2708	my_sjyc.exe
2776	rundll32.exe
2776	rundll32.exe
2776	rundll32.exe
2776	rundll32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2708-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x002c000000014c67-17.dat	upx
behavioral1/memory/2708-40-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iprip32.dll	mfc.exe
File created	C:\Windows\SysWOW64\inetsvr.exe	mfc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	2776	WerFault.exe	30

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	my_sjyc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2708	my_sjyc.exe
2708	my_sjyc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2116	3000	my_sjyc.exe	28
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 3000 wrote to memory of 2708	3000	my_sjyc.exe	29
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2116 wrote to memory of 2776	2116	mfc.exe	30
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31
PID 2776 wrote to memory of 2772	2776	rundll32.exe	31

C:\Users\Admin\AppData\Local\Temp\my_sjyc.exe
"C:\Users\Admin\AppData\Local\Temp\my_sjyc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\temp\mfc.exe
  "C:\Windows\temp\mfc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\iprip32.dll",RundllInstallA
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 280
      4⤵
      Program crash
      PID:2772
- C:\Windows\temp\my_sjyc.exe
  "C:\Windows\temp\my_sjyc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\iprip32.dll

Filesize
48KB

MD5
204d899d29f6a9976103f6928b2639ba

SHA1
3c7e654c0edc7d153d3691ef55082406819fa6d9

SHA256
ea86fe36e6eff8a14a2d948f06853a0a3320ad2fb6c32241049a1253b73997be

SHA512
91a400f4309910d3d0c548adc13c98716a4bdb6ba496da218959e84bc43e4e21d8a195e77891b1e679185334a1f271328628f22206f5ac0f1798327856577296

Download Submit
C:\Windows\Temp\my_sjyc.exe

Filesize
716KB

MD5
0e28533a6ad0e139f49df65c9dfe702b

SHA1
0457080cc9adc0bdffbfebccfd23b13ef19e5f93

SHA256
6bf3213c928d7a93536c1ac8b2ee632351087568d61f5d3639675b60528baf70

SHA512
d97a063042fc67c7d54769cafd388fc97c9fe34e0d68248490368cea96ce167eba15c913bfcff1b1527674620181568912b3947ba40ce1092a313730ffab8b3a

Download Submit
\Windows\Temp\mfc.exe

Filesize
62KB

MD5
3ca76dca44a2c72495cd1cde3da19abb

SHA1
4540fae5d520c42c86c51d32b2174a68e6ccc437

SHA256
ebdfa9061c26d5c386c525491e656ff800094318fadbb8ef05c8fd9b2c99a347

SHA512
1daee20ad02c8ac2c01d69865f79f21927ada5af6bc2c44dc86bb5e0202cf27ad6266d4737007b2aa1767491267bce04d6f13a1368b51299ce2f19e66bbc63e0

Download Submit
memory/2708-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2708-25-0x0000000000240000-0x0000000000263000-memory.dmp

Filesize
140KB

Download
memory/2708-40-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download