4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
Size

3.5MB
MD5

021ce3bb6c54febd1cf531e1e07ba08c
SHA1

079f83d244c90044699302daeec1165aff4b3280
SHA256

4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233
SHA512

37faf6d63f1eff641cb4daefe8d3cd96f2a8480d322ea7e1d7d08779e4095c45d054888bda3eb6a4e7b063787b70e527096a2ac4848ffe6fa4cf142e238be2e7
SSDEEP

49152:6dQ4omSYtiblkFLMYzIcE1x4MjjYp30g0KKpF1cER3iRHFdAQupummsDLlhySYJi:uQxmb+SpjxB0NpF6a37uuR0JxF5+F

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 36 IoCs

resource	yara_rule
behavioral1/memory/1440-0-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-7-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/files/0x0006000000016b5e-9.dat	UPX
behavioral1/files/0x0006000000016b5e-10.dat	UPX
behavioral1/memory/2516-15-0x0000000000B10000-0x00000000021FF000-memory.dmp	UPX
behavioral1/memory/2516-14-0x0000000000B10000-0x00000000021FF000-memory.dmp	UPX
behavioral1/memory/2732-19-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-20-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-21-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2732-22-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2732-28-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-29-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-30-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-31-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-34-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-35-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-36-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-37-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-38-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-39-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-40-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-41-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-42-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-43-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-44-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-45-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-46-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-47-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-48-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-49-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-50-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-51-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-52-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-53-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/1440-54-0x0000000000020000-0x000000000170F000-memory.dmp	UPX
behavioral1/memory/2112-55-0x0000000000020000-0x000000000170F000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2516	dkhuexmahiaftoukubgijncntvvwxnc-elevate.exe

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1440-0-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-7-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/files/0x0006000000016b5e-9.dat	upx
behavioral1/files/0x0006000000016b5e-10.dat	upx
behavioral1/memory/2516-15-0x0000000000B10000-0x00000000021FF000-memory.dmp	upx
behavioral1/memory/2516-14-0x0000000000B10000-0x00000000021FF000-memory.dmp	upx
behavioral1/memory/2732-19-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-20-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-21-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2732-22-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2732-28-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-29-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-30-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-31-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-34-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-35-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-36-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-37-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-38-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-39-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-40-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-41-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-42-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-43-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-44-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-45-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-46-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-47-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-48-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-49-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-50-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-51-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-52-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-53-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-54-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-55-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/1440-56-0x0000000000020000-0x000000000170F000-memory.dmp	upx
behavioral1/memory/2112-57-0x0000000000020000-0x000000000170F000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe = "11001"	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe = "11001"	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2732	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1440	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
2112	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2112	1440	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe	28
PID 1440 wrote to memory of 2112	1440	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe	28
PID 1440 wrote to memory of 2112	1440	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe	28
PID 1440 wrote to memory of 2112	1440	4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe	28

C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
"C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
  "C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe" -gpipe \\.\pipe\PCommand97zuvotpeothlgkra -gui
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
  "C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe" -cpipe \\.\pipe\PCommand96fwflpfzvckkfpku -child
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732

C:\ProgramData\Getscreen.me\dkhuexmahiaftoukubgijncntvvwxnc-elevate.exe
"C:\ProgramData\Getscreen.me\dkhuexmahiaftoukubgijncntvvwxnc-elevate.exe" -elevate \\.\pipe\elevateGS512dkhuexmahiaftoukubgijncntvvwxnc
1⤵
- Executes dropped EXE
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Getscreen.me\dkhuexmahiaftoukubgijncntvvwxnc-elevate.exe

Filesize
137KB

MD5
9e6506a1f2a493d1f474fdba7f2db0bc

SHA1
eb5fec71345e6ca6c0423c103246ccc01deb8d47

SHA256
8011c850a96c1d0151da9145f140e0589056a2ac284f00d09d5bce10139ff7ab

SHA512
a5d6136f8b82e3eef4e7cbfa3e39d202e0f3fd38607e45497a078faccdfa3b9f90381c7bd09b521d85b5dc14e8182ae19f472a9f2d695fa3bcbc92fa694053a7

Download Submit
C:\ProgramData\Getscreen.me\dkhuexmahiaftoukubgijncntvvwxnc-elevate.exe

Filesize
354KB

MD5
e143d293291880dedad3fa3112322264

SHA1
59f274b055dc34668b70bce3d7db2e295343a197

SHA256
7f7c70093151ce844c21a26c184a4621813f44da92da07dbde7bc29ac8ae4591

SHA512
2fcddf1bc896ed57ba40a75b0ad19e16f3ff60ded6da3877cd97adc055538c3673ebce622f7bba5e64fc59b659fe2fa95883b8966f29e3a13737172c2b98480d

Download Submit
C:\ProgramData\Getscreen.me\logs\20240308.log

Filesize
2KB

MD5
f6adbd3c39c15eee3447c3ea255c82d1

SHA1
3dde6ba8ed3700931a30fd8fb8cf7eb560a1eced

SHA256
45f41c3a6ea217c22ac6b1db23ced7a5c4e15a40b0486204878235fd5c15977b

SHA512
314d513ed66ce976bd3af25d94c3436bed6cff8d50076525e1778c5e59d5516a80d4431049a53a0b2b753fe5c09fddc36d2db9d59ceb60e7f2942f53fabd656d

Download Submit
C:\ProgramData\Getscreen.me\logs\20240308.log

Filesize
433B

MD5
ffa1b28c7d3f7a64f27fbc18ce10191b

SHA1
74331c892b42db5464a6220c7739ca41836db40c

SHA256
3351f5f75285a3f0d3f51d5d9a014917957a6aa42541c1bb367c1812e99d8923

SHA512
320fb12a45e23e92d866224fb7fefc1835a55833e731fcb9c7500c19984bc2e850df9d2cb9e7c74ac913d002d7f917f118d018090fc63664b700e9deb2d3d76d

Download Submit
memory/1440-20-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-50-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-46-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-52-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-44-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-0-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-48-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-23-0x0000000003E60000-0x000000000554F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-56-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-6-0x0000000003E60000-0x000000000554F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-54-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-42-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-29-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-40-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-38-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-36-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/1440-34-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-35-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-21-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-37-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-31-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-39-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-30-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-41-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-57-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-43-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-7-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-45-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-33-0x0000000001AF0000-0x0000000001AF1000-memory.dmp

Filesize
4KB

Download
memory/2112-47-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-55-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-49-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-8-0x0000000001AF0000-0x0000000001AF1000-memory.dmp

Filesize
4KB

Download
memory/2112-51-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2112-53-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2516-15-0x0000000000B10000-0x00000000021FF000-memory.dmp

Filesize
22.9MB

Download
memory/2516-14-0x0000000000B10000-0x00000000021FF000-memory.dmp

Filesize
22.9MB

Download
memory/2732-19-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2732-22-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download
memory/2732-28-0x0000000000020000-0x000000000170F000-memory.dmp

Filesize
22.9MB

Download