9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
Size

2.3MB
MD5

d980e3a1be88f079ef4031cbb6256f63
SHA1

ae36fa73ca63f375810c1bee693e4270cade6f8e
SHA256

9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639
SHA512

09f618864948a1a59609150b7bbfa875cd365125af5b417f75ac47ebb6c7f31fffe996879725241d7b0c092e447542d7e6b9b107af1049403593468b66eae421
SSDEEP

49152:flU2/ygVkB1CtDU4CXN2Va90JgUpyCq683fL+GpofuFVhrnmEH5:feoygVkB1m47X9ggm3If3ofwrrnmEH5

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral1/memory/2740-0-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral1/files/0x000b00000001565d-2.dat	UPX
behavioral1/memory/2740-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2740-47-0x00000000003B0000-0x00000000003F6000-memory.dmp	UPX
behavioral1/memory/3052-48-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral1/memory/3052-49-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/3052-67-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral1/memory/3052-68-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/2740-88-0x0000000000400000-0x0000000000446000-memory.dmp	UPX
behavioral1/memory/2740-89-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b00000001565d-2.dat	acprotect

Loads dropped DLL 4 IoCs

pid	Process
2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
3052	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
3052	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
3052	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/files/0x000b00000001565d-2.dat	upx
behavioral1/memory/2740-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2740-47-0x00000000003B0000-0x00000000003F6000-memory.dmp	upx
behavioral1/memory/3052-48-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3052-49-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3052-67-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/3052-68-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2740-88-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2740-89-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
Token: SeDebugPrivilege	3052	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3052	2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe	28
PID 2740 wrote to memory of 3052	2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe	28
PID 2740 wrote to memory of 3052	2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe	28
PID 2740 wrote to memory of 3052	2740	9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe	28

C:\Users\Admin\AppData\Local\Temp\9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
"C:\Users\Admin\AppData\Local\Temp\9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe
  "C:\Users\Admin\AppData\Local\Temp\9cadee5b34c966c026ab1d9884e268e84baa5ff4cc08be99b2b4b5136a83b639.exe" -sfxwaitall:0 "UltraISO.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\UltraISO.exe

Filesize
5.2MB

MD5
367b0bddb56a749eda324087cc743f90

SHA1
3cdbe4777c8147f30e326bb7f5c07d46bcd5425c

SHA256
245888f334805afb6afae465a0b456c70d74a95b12644d814a56cfca60a7b98b

SHA512
48442469cab8d2029cf2d31c869b9c5eb2d3b34affc40ddcda2741047abbec76975dcaf5f9251ed4b78b31e23a8f8f94468678aa561726f2e4287bfa2ead2399

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\drivers\FileDlg.exe

Filesize
83KB

MD5
b1cd3f9e805d2225133ba99ca93d34bc

SHA1
44d16b2677eec775b99ac6c85a6a7f533e0d5550

SHA256
2fa5c3457aacb299886d27254a5da71d4b7715c41ed57f10a492b48e8f8f37c5

SHA512
1efdeec7194bd99697e27c1fa042a728ee3acc6e048ac0e1ce47ca21994ea4907c6ce901cfa8c757e08c06719da12171168d6f10d5b8f20c1d8942c49a3fb3a4

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\drivers\IsoCmd.exe

Filesize
28KB

MD5
55677a521dd34ce7a93ab3f1d12b2dfd

SHA1
4316dd2b5e4ebb48886955ec5365b2f40d4298b3

SHA256
fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

SHA512
e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\drivers\bootpart.exe

Filesize
29KB

MD5
1795c231239aaa1d5cb9f5b9191782b5

SHA1
166eeafcdde8bb732c60dc1eee3b3cad41c52244

SHA256
d32a5a4c3135d93ec6a40d815bae5be3cc63833c902c3db4cf7bb4a30d07756b

SHA512
3ce4458af4a4b100dee4e900271d0b5489812956e57385d7abafcaf6afcc6e348a82f9611ce1dae6c8eb89362a48ca230f6ea6ae5a1aa1fa4ee8f5a6ec8f3873

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\isoshell,2.dll

Filesize
77KB

MD5
bdcc1a4b4d745db4397b6ae3eb9c954b

SHA1
9ab18e41e17898aaf82d37dabb0811dcd0ed9947

SHA256
19d13f1930210741ba580c0d031121435c225953b5203823fbe18c1e8d58b94b

SHA512
f840c1f3d826a67c9a9d0eaace282f2baf23f857d4a26f14106a3917f409179a3b1348b9d0cc47a15225cc38d9344b676aabaa5f7f161e1d3720790ec52bae2d

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\isoshl64,2.dll

Filesize
151KB

MD5
c0fc6c67bd9d9fbc4f8ad44232d49d11

SHA1
e5ad2b56cc20652401ee5c60fe118cf3fb474a7b

SHA256
50df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503

SHA512
74bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586

Download Submit
\??\c:\users\admin\appdata\local\temp\7zipsfx.000\lame_enc.dll

Filesize
962KB

MD5
b9e34ae6d6ecb1e19b36dc70e7ef406c

SHA1
014985ed2dab57e606e08788fc9177220dd2aed1

SHA256
3b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4

SHA512
d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\UltraISO.exe.tmp

Filesize
5.3MB

MD5
3e36ff6ff8ffed58f28ab62a2e5fb122

SHA1
8f948bb88df98c93d14feede634b6e8d68407964

SHA256
33091e337b2d946a55ea3fc8260c6ee9926ee7806f53b7666bcc628ac926fcdc

SHA512
9bd647c1118ec640764d12d060ace9592335ce643c28ef686618a91faea762e4bd75c8bffdad1986a408619977ce41fe049cf14baf6965db7fadbfc71069b0b2

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\drivers\FileDlg.exe.tmp

Filesize
160KB

MD5
d875d83247f7a92bed6019c4cd49d941

SHA1
3d7d0ce4d540aadcd98c98018c117403f64cd0f9

SHA256
a2410c6c7c3f4176a2185f9833974885f5ab993c359f36dd5d01625ea446d0ea

SHA512
4b82acf51dc9e9dba8c8bc2d0cfe29cec48b079b04f0e5b09a516b090507d54d317bc0e74b8725b5ae3b66f234c8dcc1f9de3db7284b076caa618e01b09b76b8

Download Submit
memory/2740-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2740-90-0x00000000003B0000-0x00000000003B2000-memory.dmp

Filesize
8KB

Download
memory/2740-47-0x00000000003B0000-0x00000000003F6000-memory.dmp

Filesize
280KB

Download
memory/2740-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2740-88-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2740-89-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3052-49-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3052-68-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3052-67-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3052-48-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download