537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e

General

Target

537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe
Size

12.9MB
MD5

b7bae4cd7026ca4a3692880b73a22fbe
SHA1

a473463d5ca9e0fac7958fdef107c075280d4cce
SHA256

537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e
SHA512

9119a9608765e2676dc01085b7b01db7b55224f48bee36cb92e46f6d80641d77f373ead241a7979cc532fe3e31b2d1ebd3596b8e80b0e600e444e040c96c7d48
SSDEEP

393216:Ek/6NSxCUC8Hr8xcKUGt/YQAZp167N8qos:PSNSwUC6J1GtA106q9

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000015cb7-9.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-0-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-1-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/memory/2128-4-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-5-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/files/0x0009000000015cb7-9.dat	upx
behavioral1/memory/2128-11-0x0000000008070000-0x000000000810F000-memory.dmp	upx
behavioral1/memory/2128-146-0x0000000008070000-0x000000000810F000-memory.dmp	upx
behavioral1/memory/2128-145-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-147-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-148-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-149-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-151-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-152-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-154-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-156-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-158-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-160-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-162-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-164-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-166-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-168-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-170-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-172-0x0000000000400000-0x000000000088B000-memory.dmp	upx
behavioral1/memory/2128-174-0x0000000000400000-0x000000000088B000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe
2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2600	2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe	28
PID 2128 wrote to memory of 2600	2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe	28
PID 2128 wrote to memory of 2600	2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe	28
PID 2128 wrote to memory of 2600	2128	537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe	28

C:\Users\Admin\AppData\Local\Temp\537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe
"C:\Users\Admin\AppData\Local\Temp\537d6355448c51449fbe1f7b43ef6ddefbd73bc3843300629b7e57546c25a90e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cacls.exe
  cacls "" /e /p everyone:n
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f7624fe.tmp\data.ini

Filesize
1KB

MD5
56564fd57e6761e0eaf2ce20a85ada2d

SHA1
e270f5218208fc94ac9596035236d770487fb985

SHA256
c16d311e07580aac2520322bc9ffb40b83922d4b3dc644981535d85f8f732128

SHA512
7e5fae87861876c2147b91207fa73fdc356d742a17ebd79f97df494aea84b8bde3c7bd65d3b31e6f026a55f1b2a694ed0522aa41065ae3d0a25b86c2dd7cb7c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\f7624fe.tmp\data.ini

Filesize
1KB

MD5
af70305bac0b8814248580c4e1cb5bda

SHA1
c82fe4449e7d299e0e80c865a98637e60f45b3b8

SHA256
af76272f4be87ab41c8d2a8a56ba35aec0edf6cec11c309951e9d35a55ccb79c

SHA512
530efdabc73216e1a58b1d7854a47b5ee6036744870c9d3dec42905d0d05374c52de24f94a9f738c2aa84b1ba8186e46bdbf75b0de2b36cb2978fe2784c3189f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f7624fe.tmp\variable.ini

Filesize
761B

MD5
21fa746f8d554d0f4fd1257bb77fed19

SHA1
ef818ec6f9d54b9df90fc1e18fe795f76b22e0de

SHA256
f9834c6a2bde77599fc0df69d74d020d12b865de31176a48ad4404809ead8379

SHA512
cb6c743b07f31ec5611ef332de1b4fdd1f874a2cb024b5a359226df53616b5f329a72b896b8be4f8292d43bc563115ecc9fd35a697f050c17cbb7392dabaf4a2

Download Submit
\Users\Admin\AppData\Local\Temp\7-zip32_2.dll

Filesize
233KB

MD5
ea3df059beae86a3e186b2b179755e77

SHA1
babdcd6b5082c02fa2f5ebc2020f2cb3bbd77e8d

SHA256
1ab68a0c296281437fe638c8535309c6241ded4852608d940f5efcb8cc2d91a6

SHA512
1406d8083cfbd26e18aba74f6b45a09137bb3960f7afce5c5d0d790b0edb7277b7b885ed2ded9def12b667bcb37cbfb335884b2d7b8f08565743b674d1f053bb

Download Submit
memory/2128-149-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-151-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-11-0x0000000008070000-0x000000000810F000-memory.dmp

Filesize
636KB

Download
memory/2128-4-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-3-0x00000000004B4000-0x00000000004B5000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2128-146-0x0000000008070000-0x000000000810F000-memory.dmp

Filesize
636KB

Download
memory/2128-145-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-147-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-148-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-0-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-5-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-152-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-154-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-156-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-158-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-160-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-162-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-164-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-166-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-168-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-170-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-172-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download
memory/2128-174-0x0000000000400000-0x000000000088B000-memory.dmp

Filesize
4.5MB

Download

Analysis

Sharing