4a24ef073dd47ddf457272a9d848eff1da79aa7601e7acf1ca68f0039371e962

General

Target

df91b1c6d225bda2cfc560bec649fefe.exe
Size

123KB
MD5

df91b1c6d225bda2cfc560bec649fefe
SHA1

581e773d46181ee4cae6d495680f0c5b433536e4
SHA256

4a24ef073dd47ddf457272a9d848eff1da79aa7601e7acf1ca68f0039371e962
SHA512

a05398993da5a396c6a5b6492c3bd952d55676ccafbf06e35aea892b9aab6b7e2112219eba83d85071ba71415e9acbd5b037736cec1abb93ee5596a8c4680361
SSDEEP

3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLLX/bmV:OVYrJrOSsRwcpd6V

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo jimddp = "electronic-group"	iaccess32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000018bb0-30.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2752	iaccess32.exe

Loads dropped DLL 3 IoCs

pid	Process
2552	regsvr32.exe
2752	iaccess32.exe
2752	iaccess32.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2488-7-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00050000000120fe-6.dat	upx
behavioral1/memory/2488-2-0x0000000000270000-0x000000000029E000-memory.dmp	upx
behavioral1/memory/2752-9-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0006000000018bb0-30.dat	upx
behavioral1/memory/2552-32-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral1/memory/2752-80-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-81-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-83-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-84-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-85-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-86-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-88-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-89-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-90-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-91-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-92-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-93-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-94-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-95-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2752-96-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\medias\p2e.ico	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\instant access.exe	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\medias\p2e_logo_2.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\medias\p2e_2_3.gif	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20100626020628\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\medias\p2e_1_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\medias\p2e_3_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\Common\module.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100626020628\medias\p2e_go_3.gif	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\iaccess32.exe	df91b1c6d225bda2cfc560bec649fefe.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iaccess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
2936	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	df91b1c6d225bda2cfc560bec649fefe.exe
2752	iaccess32.exe
2752	iaccess32.exe
2752	iaccess32.exe
2752	iaccess32.exe
2752	iaccess32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2752	2488	df91b1c6d225bda2cfc560bec649fefe.exe	28
PID 2488 wrote to memory of 2752	2488	df91b1c6d225bda2cfc560bec649fefe.exe	28
PID 2488 wrote to memory of 2752	2488	df91b1c6d225bda2cfc560bec649fefe.exe	28
PID 2488 wrote to memory of 2752	2488	df91b1c6d225bda2cfc560bec649fefe.exe	28
PID 2752 wrote to memory of 2936	2752	iaccess32.exe	29
PID 2752 wrote to memory of 2936	2752	iaccess32.exe	29
PID 2752 wrote to memory of 2936	2752	iaccess32.exe	29
PID 2752 wrote to memory of 2936	2752	iaccess32.exe	29
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30
PID 2752 wrote to memory of 2552	2752	iaccess32.exe	30

C:\Users\Admin\AppData\Local\Temp\df91b1c6d225bda2cfc560bec649fefe.exe
"C:\Users\Admin\AppData\Local\Temp\df91b1c6d225bda2cfc560bec649fefe.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - Runs regedit.exe
    PID:2936
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Instant Access\Multi\20100626020628\dialerexe.ini

Filesize
587B

MD5
e2603553783c8006bf618423147a9f74

SHA1
6116dd0a4a11e6da455664ed44dae88d1ef482f1

SHA256
1d15099a9233f5e6b17644ecbe48db2b73ec387e4363c2c0808df01ced96fda1

SHA512
3af0e73c7e4b16d38521bf881d47cb819b0825392aeaa36a9bc238e674e0c53cde81ed166f97960d83b586736e456f30412a070e3617827acec62558ac614922

Download Submit
C:\Windows\SysWOW64\egaccess4_1071.dll

Filesize
76KB

MD5
b83f652ffa76451ae438954f89c02f62

SHA1
b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

SHA256
f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

SHA512
965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

Download Submit
C:\Windows\iaccess32.exe

Filesize
123KB

MD5
16cdb6e283941b503d80200f8a370894

SHA1
fb2a155622e296ffd92f1431dc725f300292597c

SHA256
ca2eaf08d02d4bf233c9a8433d748098ceac9cdb2fea5e02e4df3678cdab3034

SHA512
dd2b9745565aed713cc021d7e77a9c91e429386175afd1fe1a61a524df49a5e59b502d41aa640513e227a8a9534de1ce9374fe4e0bc530b230759b9edc67429c

Download Submit
C:\Windows\tmlpcert2007

Filesize
6KB

MD5
b103757bc3c714123b5efa26ff96a915

SHA1
991d6694c71736b59b9486339be44ae5e2b66fef

SHA256
eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

SHA512
d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

Download Submit
memory/2488-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2488-2-0x0000000000270000-0x000000000029E000-memory.dmp

Filesize
184KB

Download
memory/2488-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2552-32-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/2752-81-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-86-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-57-0x0000000001E10000-0x0000000001E20000-memory.dmp

Filesize
64KB

Download
memory/2752-80-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-82-0x0000000001E10000-0x0000000001E20000-memory.dmp

Filesize
64KB

Download
memory/2752-83-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-84-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-85-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-45-0x0000000001E10000-0x0000000001E20000-memory.dmp

Filesize
64KB

Download
memory/2752-88-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-89-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-90-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-91-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-92-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-93-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-94-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-95-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2752-96-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing