50f87d1d3cfbc48c306635dc97ecc4d692496066082ee74a9b26cb14ccb9390b

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df931ebf172f5ace7adc014f4e31c7fc.exe
Size 123KB
Sample240326-tn221adh66
SHA256 50f87d1d3cfbc48c306635dc97ecc4d692496066082ee74a9b26cb14ccb9390b
MD5 df931ebf172f5ace7adc014f4e31c7fc
SHA1 6e8e619bdb0cd69460598e71e53ad97e5f6acdb0
SHA512 25f06e63899e68d2cc9dd0b441aa32c967ccb924d43f2a4c1726f7d0bf27dd6dead48b6733d7858f17fd338d8729c3429d9e32bd39c3cc3c52d05da33ddc3ac8
SSDEEP 3072:OeSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLL45MMURO:OVYrJrOSsRwcpaURO
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023334-26.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	iaccess32.exe

Executes dropped EXE 1 IoCs

pid	Process
3588	iaccess32.exe

Loads dropped DLL 1 IoCs

pid	Process
216	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/472-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0008000000023325-3.dat	upx
behavioral2/memory/472-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3588-5-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0007000000023334-26.dat	upx
behavioral2/memory/216-28-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral2/memory/3588-58-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\medias\p2e_2_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\medias\p2e.ico	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\medias\p2e_1_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\medias\p2e_3_3.gif	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\instant access.exe	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20100709060734\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\Common\module.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\medias\p2e_logo_2.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20100709060734\medias\p2e_go_3.gif	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe
File created	C:\Windows\iaccess32.exe	df931ebf172f5ace7adc014f4e31c7fc.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\IESettingSync	iaccess32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iaccess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iaccess32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\À	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
3888	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
472	df931ebf172f5ace7adc014f4e31c7fc.exe
3588	iaccess32.exe
3588	iaccess32.exe
3588	iaccess32.exe
3588	iaccess32.exe
3588	iaccess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 3588	472	df931ebf172f5ace7adc014f4e31c7fc.exe	94
PID 472 wrote to memory of 3588	472	df931ebf172f5ace7adc014f4e31c7fc.exe	94
PID 472 wrote to memory of 3588	472	df931ebf172f5ace7adc014f4e31c7fc.exe	94
PID 3588 wrote to memory of 3888	3588	iaccess32.exe	97
PID 3588 wrote to memory of 3888	3588	iaccess32.exe	97
PID 3588 wrote to memory of 3888	3588	iaccess32.exe	97
PID 3588 wrote to memory of 216	3588	iaccess32.exe	98
PID 3588 wrote to memory of 216	3588	iaccess32.exe	98
PID 3588 wrote to memory of 216	3588	iaccess32.exe	98

C:\Users\Admin\AppData\Local\Temp\df931ebf172f5ace7adc014f4e31c7fc.exe
"C:\Users\Admin\AppData\Local\Temp\df931ebf172f5ace7adc014f4e31c7fc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - Runs regedit.exe
    PID:3888
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:8
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dialerexe.ini

Path C:\Program Files (x86)\Instant Access\Multi\20100709060734\dialerexe.ini
Size 587B
SHA256 a6f6ff543fdc76243bab5d54023755fa9068f6123caee5d4f50e1a5f38814d24
MD5 7e70c47d6f798473ca39afc19e2a6ca3
SHA1 22934c3e4181f6c2b31a5848d9a11e8814911ff9
SHA512 38ae99f2f73b444cfb08823f69e9160f30ce55dac520e553efca5462d56a4ae287384fc1de4bfe3b786f87993153a82bb48368a5f669cddc8f543fe78c64b1f0
MD5 SHA1 SHA512

Submit Download

NOCREDITCARD.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\NOCREDITCARD.lnk
Size 2KB
SHA256 beee28c127eac6ce885db39b7e1ef33164ed0e3d9b01376ad1896ebd812cdf58
MD5 c7afaaebebf710985349df72bd42e01f
SHA1 d32ff92818554a396873fef5b6bf41b6ecff87cf
SHA512 b0901a26d709514cb65584a33e6ea2da17f0a5905fe6db714be470c0a2c769a873d36550b3b12501ae295fc051f307ccf2e6c6e3b69023b32e39f884b8ec8a60
MD5 SHA1 SHA512

Submit Download

NOCREDITCARD.lnk

Path C:\Users\Public\Desktop\NOCREDITCARD.lnk
Size 2KB
SHA256 8eaaf599a6d7b4bacd2739952262e4df25d6e3b0c220faa8d372978e057933e4
MD5 0d73898516585cdaa792298f0942a9b5
SHA1 88edd134a696a72dd923adcc8710f57ff37f9f07
SHA512 a86f49c5416d7758d1b43d6ec251d806007fddbd445c6ef3911e978f78ffdb1a8f13fd6fc9dc05d13381eb83a3fa375dd53f9287f755996007a0b10e98b63d99
MD5 SHA1 SHA512

Submit Download

egaccess4_1071.dll

Path C:\Windows\SysWOW64\egaccess4_1071.dll
Size 76KB
SHA256 f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f
MD5 b83f652ffa76451ae438954f89c02f62
SHA1 b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd
SHA512 965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83
SSDEEP 1536:Hn/ctpn5sgsEMbUie/sqalYuhzm4Jf1O8hRQVVTuPcNuSa85yXUct7piq:Hnk9sX1qalYuhLJNdjQVVTuP5J85Vi9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

iaccess32.exe

Path C:\Windows\iaccess32.exe
Size 123KB
SHA256 ec08a7e5a2f061ae8b9b3982deaf9fa344763281266b5d94979458eae20629e9
MD5 359ba50acf6560a0b949bc38a4f1af9b
SHA1 ad4b6843f0af234b9bcc4c4fe75aab76a5c6d0ef
SHA512 3d98f33a6eae87c429d819584064b77d5376dcd78b1822e5aeaa3cc9673da945a24346598b859312d0d15b31106c6f694ab833912bf760098391ad07b5ed4724
SSDEEP 3072:ueSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLL45MMURO:uVYrJrOSsRwcpaURO
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmlpcert2007

Path C:\Windows\tmlpcert2007
Size 6KB
SHA256 eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48
MD5 b103757bc3c714123b5efa26ff96a915
SHA1 991d6694c71736b59b9486339be44ae5e2b66fef
SHA512 d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1
SSDEEP 96:NKKrAuYrNa7vSePKH4W0wMK6RdWnhW0g0sOxFZ91MaQl4MwEwuN3CoW0yAypDE2v:d0uYRdePKVR6CcBK5MaQlTwYN32D7/UK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-28-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/472-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/472-6-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3588-5-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3588-58-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads