44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Size

229KB
MD5

8813393f8a3e4ebb97e0a846367ce1e7
SHA1

fd4db90feccae7daf292644e0839e42534904c9c
SHA256

44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec
SHA512

e69af8a53b79c989211197900bd05a1725d6abdfdfb4db7dc6e18ba9d79c28a4456daa62b2cc08de3a438a6d7129ab447de00a9e1a318a244e135635d0eff1f4
SSDEEP

3072:l1Upt1DlS2KyYzDhLrLeBdVw9+TpFLMHb+lXpQK5:CYzdLQa8z0yQQ

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00090000000233ce-10.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3640	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3452-0-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/files/0x00090000000233ce-10.dat	upx
behavioral2/files/0x000100000000002a-13.dat	upx
behavioral2/memory/3452-16-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/3640-17-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\M:	spoolsv.exe
File opened (read-only)	\??\L:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\V:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\H:	spoolsv.exe
File opened (read-only)	\??\S:	spoolsv.exe
File opened (read-only)	\??\N:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\G:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\O:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\E:	spoolsv.exe
File opened (read-only)	\??\G:	spoolsv.exe
File opened (read-only)	\??\J:	spoolsv.exe
File opened (read-only)	\??\E:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\R:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\S:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\V:	spoolsv.exe
File opened (read-only)	\??\P:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\J:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\K:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\T:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\Q:	spoolsv.exe
File opened (read-only)	\??\H:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\K:	spoolsv.exe
File opened (read-only)	\??\N:	spoolsv.exe
File opened (read-only)	\??\O:	spoolsv.exe
File opened (read-only)	\??\T:	spoolsv.exe
File opened (read-only)	\??\U:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\I:	spoolsv.exe
File opened (read-only)	\??\L:	spoolsv.exe
File opened (read-only)	\??\P:	spoolsv.exe
File opened (read-only)	\??\U:	spoolsv.exe
File opened (read-only)	\??\I:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened (read-only)	\??\R:	spoolsv.exe
File opened (read-only)	\??\Q:	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\JKVINFZ.dll	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File opened for modification	C:\Windows\SysWOW64\JKVINFZ.dll	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
File created	C:\Windows\SysWOW64\KEHQLV.dll	spoolsv.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JKVINFZ.ShellExecuteHook1005	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JKVINFZ.ShellExecuteHook1005\ = "Maihook1005"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JKVINFZ.ShellExecuteHook1005\Clsid	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\DFile = "051036065052045077083059051038066255083066078008225114236209077115107014036002178165166231182179013097239137030139051186181206002107"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ = "Maihook1005"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\EFile = "050045088052034068221254051039068238247071138084030237134200192037119059081013060232060149244080250053178140003232226159"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ = "C:\\Windows\\SysWow64\\JKVINFZ.dll"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JKVINFZ.ShellExecuteHook1005\Clsid\ = "{4D65F220-63CA-11D8-9BDB-FD58F515A839}"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID\ = "JKVINFZ.ShellExecuteHook1005"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ThreadingModel = "Apartment"	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
3640	spoolsv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3640	3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe	87
PID 3452 wrote to memory of 3640	3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe	87
PID 3452 wrote to memory of 3640	3452	44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe	87

C:\Users\Admin\AppData\Local\Temp\44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe
"C:\Users\Admin\AppData\Local\Temp\44c585076e523a229f3a949b65b223a4d080273aa664d0eaa3e553e63a240dec.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452
- F:\$RECYCLE.BIN\spoolsv.exe
  F:\$RECYCLE.BIN\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\JKVINFZ.dll

Filesize
276KB

MD5
6e957d87e122cc8c661d98990c338bdf

SHA1
620b2ac415d35a78a2fc90f82c4b84c1ec8ec38b

SHA256
0d8ac992267263b81c011f3df915cb09a804f38021a659fc00d16648fe903ce2

SHA512
0ee81e64b6e0268da0c548cc14596a183ac4d01d30b824a857d401c20ea00a82166eb523d893fd3f676211dac74c42f476930a81e12eb9c68722335a5e2f9ca9

Download Submit
F:\$RECYCLE.BIN\spoolsv.exe

Filesize
230KB

MD5
ae1fb58fb145ffc5f1a495674c12240e

SHA1
2df2937c7ebdcba0462c92762c632268ff3b6835

SHA256
422e9d89edf2ab3b6c544314b730f1d07d331efdb7641729348ed632c9c275b7

SHA512
cdda03d7febe207ed3387c652713b7d7337e7acb94e90285356a4e24c9d3561b07f6221ef91a0b7c85a41c3737269e1146e5420fc57272c1dd178d33dba82468

Download Submit
memory/3452-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3452-15-0x00000000006D0000-0x00000000006F0000-memory.dmp

Filesize
128KB

Download
memory/3452-14-0x00000000006D0000-0x00000000006F0000-memory.dmp

Filesize
128KB

Download
memory/3452-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3640-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download