Overview

overview

7

Static

static

3

spjti.exe

windows7-x64

7

spjti.exe

windows10-2004-x64

7

新云软件.url

windows7-x64

1

新云软件.url

windows10-2004-x64

1

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-03-2024 23:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    spjti.exe

  • Size

    1.4MB

  • MD5

    cd26ee8391850957a25b2e0f40d69f3f

  • SHA1

    6723605698784898029a758a2633631268f2f34e

  • SHA256

    933a38f0a4150f50035743a5cf63fe65fbd950dfb02b6a86c7241db517ac8e29

  • SHA512

    50b3764ba0a6467813a7c7cbb2fd54bb116b4c4b0549b671d8594a0c15578b839f97e891df604deb3666874b6ad337d486b0494e094f8380d835410486c4ad51

  • SSDEEP

    24576:0NSIjzhzmjLslR7QDRBkc5dZ2w3Dx85fmawXUeIEsC5giC8Kz:0NSIjdRHMacPZ2AUma2W2gGI

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\spjti.exe
    "C:\Users\Admin\AppData\Local\Temp\spjti.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\GLC5560.tmp
    Filesize

    161KB

    MD5

    315f8d68ff1a414806e7344ac8dd8b6d

    SHA1

    8fe6719bdf12244e8ef154e36c77ec487dbafeff

    SHA256

    90b9dfcb65f6e6cd0123f44cbf8310659f4c7ca4488a57d3045f72d55a9771e9

    SHA512

    95a5efdaf8f620f85838be6eb59768a421059595c1e07dd6680aac3bfd371075f1c9528cb2dceefb333c72ed6821a6e592ca7d16e2923f39212a0e1ffdba296a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\GLK5590.tmp
    Filesize

    33KB

    MD5

    a6601202dda81c941e14dd79878ca61d

    SHA1

    a436aa8bd1d6b501d30f01c4587fb32d513038f4

    SHA256

    7906a8f868986edda9f7c4df0d93ed862959b81344a475f452b9e31c1aece464

    SHA512

    c27d32541f21e0a5aa45939855d4cddfec04ec466a1231d419b29cf07157751bf778ef851868181a0392fbe6ddcabf372b7a2d35519b5b3a2bda21ff7192a5b4

    Download Submit

  • \Windows\SysWOW64\plpl.dll
    Filesize

    269KB

    MD5

    0c9660cfd6736d69e494651a72162f5f

    SHA1

    77891033187146f1746ef50468cc36ba167c39da

    SHA256

    15281397b7e7c34d95e53fd14e394d2997b31a04b33e1e443e9532b2bb34adac

    SHA512

    c3f814cc4d2343804cb6928c33d5aa855b04943cae504e18a809fd2c7fb0547326375aeaa64fb0acd854a4d1d38f54cccf563722e7e980e3d985d487629eb2b5

    Download Submit

  • memory/2696-12-0x00000000020A0000-0x0000000002158000-memory.dmp

    Filesize

    736KB

    Download

  • memory/2696-13-0x00000000020A0000-0x0000000002158000-memory.dmp

    Filesize

    736KB

    Download