60c4175e18abf22d705d855abb6f16e08b80b9fb829a08589b9e4ba750c47349

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SkrinshoterSetup_v3.11.4.30.exe
Size

3.4MB
MD5

061ba6da7357850ca194496766009f59
SHA1

b31cdf2c231212c3c76c1e2616c1d04f44d89118
SHA256

60c4175e18abf22d705d855abb6f16e08b80b9fb829a08589b9e4ba750c47349
SHA512

8607833b8c8653545fdca0cd9011fff642622e98afb6e91503aa8a7534ff222b6821088d4e553babdb50b132d1aa42517033e584251816a574bd575ee18bccaa
SSDEEP

98304:njGHuYqJ/x+OJQgQyiN5dvdlqNLOFCuAC4R/z5xQgJ:nKHuYMfYyiRvgL1uZa/z5rJ

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000016d07-20.dat	acprotect
behavioral1/memory/2320-36-0x00000000742B0000-0x00000000742B9000-memory.dmp	acprotect
behavioral1/memory/2320-59-0x00000000744A0000-0x00000000744A9000-memory.dmp	acprotect
behavioral1/memory/2320-86-0x00000000744A0000-0x00000000744A9000-memory.dmp	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2940	LauncherSRF.exe

Loads dropped DLL 19 IoCs

pid	Process
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe
2320	SkrinshoterSetup_v3.11.4.30.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016d07-20.dat	upx
behavioral1/memory/2320-36-0x00000000742B0000-0x00000000742B9000-memory.dmp	upx
behavioral1/memory/2320-59-0x00000000744A0000-0x00000000744A9000-memory.dmp	upx
behavioral1/memory/2320-86-0x00000000744A0000-0x00000000744A9000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\yandexbarpage2.ini	SkrinshoterSetup_v3.11.4.30.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2940	LauncherSRF.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	SkrinshoterSetup_v3.11.4.30.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28
PID 2320 wrote to memory of 2940	2320	SkrinshoterSetup_v3.11.4.30.exe	28

C:\Users\Admin\AppData\Local\Temp\SkrinshoterSetup_v3.11.4.30.exe
"C:\Users\Admin\AppData\Local\Temp\SkrinshoterSetup_v3.11.4.30.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\LauncherSRF.exe
  C:\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\LauncherSRF.exe "C:\Program Files (x86)\Skrinshoter\skrinshoter.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\yandexbarpage2.ini

Filesize
4KB

MD5
824b5a697bf352eee30f2dc9f4d726d9

SHA1
0e13ef711fef158493e517402201dbe95cdcf758

SHA256
3eb088d1a61d0cbd5a4282cd5d55c021fe31795afa330925eec623d2e602b892

SHA512
456e59f4c2e1d2ad6be9876be76be8dcb9938fc57ddc806121361d4a3c07929cd98fc356a2e83b6a927e739351aa852a25c90552f4515d8f8086c3848470b216

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\InstallOptions.dll

Filesize
15KB

MD5
89351a0a6a89519c86c5531e20dab9ea

SHA1
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

SHA256
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

SHA512
13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\LauncherSRF.exe

Filesize
142KB

MD5
439682e20cd3b52b73127888772892e9

SHA1
11a2f12ea9bb3319a7070bbbe9c73bef5e0f1846

SHA256
1db6f336eac2947e467243ac4f7b87cd5de253939351e6476653a10365a69848

SHA512
5e8ac59db831fafd00cbb2650bb4222f9c222569927258bacc288b47797d16bf9a220edb18e6ff15470e175928993488a2ada07ee3c14939f12b94be43b7e1ab

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Local\Temp\nsd22FC.tmp\nsResize.dll

Filesize
4KB

MD5
a8655e0ca9e079edc631838273afc087

SHA1
20c4468e90f961c499870cfa6a179c82f6d72675

SHA256
eeb2705599c3075e652762e74c88d3cb482e01ad8cae65f02022f91aebf13cb5

SHA512
383201fc7f0d15f0d02ae638e411becac61eb5f475020220035ba6df560aee23cbb90082e6827aeaba434e150c08df87914e3cea308ed197f86d560eacc369e1

Download Submit
memory/2320-67-0x00000000742B0000-0x00000000742B9000-memory.dmp

Filesize
36KB

Download
memory/2320-34-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-36-0x00000000742B0000-0x00000000742B9000-memory.dmp

Filesize
36KB

Download
memory/2320-64-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-59-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-86-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-88-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-87-0x00000000742B0000-0x00000000742B9000-memory.dmp

Filesize
36KB

Download
memory/2320-40-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-42-0x00000000742B0000-0x00000000742B9000-memory.dmp

Filesize
36KB

Download
memory/2320-46-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/2320-370-0x00000000742B0000-0x00000000742B9000-memory.dmp

Filesize
36KB

Download