c58f7a0bb02aed16adcbba017e510d08485175b25fb4c03007cf7a606aec7b54

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

codecmanager.exe
Size

546KB
MD5

4f074e26182b981e1584245af284d3e6
SHA1

b264cf16eb822effbde5be66a82a38094807730f
SHA256

e13b36df1b5980d1a4e2998323e1e68b658d27fc7e33dce34fd6790096b7a045
SHA512

152bf35a23eae446ab3dd3722daa1b51d73441f5e2b0c7d6924bb44714820c73626d4d3e4d79c13daf34e474f774a737eef7e339d164dc5070db6e8b653fb385
SSDEEP

12288:NCEwflgiFhi/1mFdW1JW73v8UjgDuNq8ZyPIxyY8o2A:PwfCOW1A7jTmIMY8oT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral19/memory/2980-0-0x0000000000400000-0x0000000000553000-memory.dmp	upx
behavioral19/memory/1848-3-0x0000000000400000-0x0000000000A7F000-memory.dmp	upx
behavioral19/memory/1848-5-0x0000000000400000-0x0000000000A7F000-memory.dmp	upx
behavioral19/memory/1848-7-0x0000000000400000-0x0000000000A7F000-memory.dmp	upx
behavioral19/memory/2980-8-0x0000000000400000-0x0000000000553000-memory.dmp	upx

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\BsCdcdlcteke-tmpkey	codecmanager.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\BSCDCDLCTEKE-TMPKEY	codecmanager.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe
1848	bsplayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	codecmanager.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2980	codecmanager.exe
Token: SeSecurityPrivilege	2980	codecmanager.exe
Token: SeLoadDriverPrivilege	2980	codecmanager.exe
Token: SeSystemProfilePrivilege	2980	codecmanager.exe
Token: SeSystemtimePrivilege	2980	codecmanager.exe
Token: SeProfSingleProcessPrivilege	2980	codecmanager.exe
Token: SeIncBasePriorityPrivilege	2980	codecmanager.exe
Token: SeCreatePagefilePrivilege	2980	codecmanager.exe
Token: SeShutdownPrivilege	2980	codecmanager.exe
Token: SeDebugPrivilege	2980	codecmanager.exe
Token: SeSystemEnvironmentPrivilege	2980	codecmanager.exe
Token: SeRemoteShutdownPrivilege	2980	codecmanager.exe
Token: SeUndockPrivilege	2980	codecmanager.exe
Token: SeManageVolumePrivilege	2980	codecmanager.exe
Token: 33	2980	codecmanager.exe
Token: 34	2980	codecmanager.exe
Token: 35	2980	codecmanager.exe
Token: SeIncreaseQuotaPrivilege	1848	bsplayer.exe
Token: SeSecurityPrivilege	1848	bsplayer.exe
Token: SeLoadDriverPrivilege	1848	bsplayer.exe
Token: SeSystemProfilePrivilege	1848	bsplayer.exe
Token: SeSystemtimePrivilege	1848	bsplayer.exe
Token: SeProfSingleProcessPrivilege	1848	bsplayer.exe
Token: SeIncBasePriorityPrivilege	1848	bsplayer.exe
Token: SeCreatePagefilePrivilege	1848	bsplayer.exe
Token: SeShutdownPrivilege	1848	bsplayer.exe
Token: SeDebugPrivilege	1848	bsplayer.exe
Token: SeSystemEnvironmentPrivilege	1848	bsplayer.exe
Token: SeRemoteShutdownPrivilege	1848	bsplayer.exe
Token: SeUndockPrivilege	1848	bsplayer.exe
Token: SeManageVolumePrivilege	1848	bsplayer.exe
Token: 33	1848	bsplayer.exe
Token: 34	1848	bsplayer.exe
Token: 35	1848	bsplayer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	codecmanager.exe
1848	bsplayer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1848	2980	codecmanager.exe	28
PID 2980 wrote to memory of 1848	2980	codecmanager.exe	28
PID 2980 wrote to memory of 1848	2980	codecmanager.exe	28
PID 2980 wrote to memory of 1848	2980	codecmanager.exe	28

C:\Users\Admin\AppData\Local\Temp\codecmanager.exe
"C:\Users\Admin\AppData\Local\Temp\codecmanager.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\bsplayer.exe
  C:\Users\Admin\AppData\Local\Temp\bsplayer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-3-0x0000000000400000-0x0000000000A7F000-memory.dmp

Filesize
6.5MB

Download
memory/1848-5-0x0000000000400000-0x0000000000A7F000-memory.dmp

Filesize
6.5MB

Download
memory/1848-4-0x0000000000405000-0x0000000000406000-memory.dmp

Filesize
4KB

Download
memory/1848-7-0x0000000000400000-0x0000000000A7F000-memory.dmp

Filesize
6.5MB

Download
memory/2980-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2980-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2980-2-0x00000000036A0000-0x0000000003D1F000-memory.dmp

Filesize
6.5MB

Download
memory/2980-8-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2980-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2980-10-0x00000000036A0000-0x0000000003D1F000-memory.dmp

Filesize
6.5MB

Download