74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe
Size

4.1MB
MD5

50415b52ed9d53f625a4d80f64f64938
SHA1

8d85bd5c07b5d30d8e46d027d6d6d2cd45481841
SHA256

74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3
SHA512

067b1bc48d185d69ca6bee95aac2bee8ed95264c7c2b3b1c2edebd75f59b9420360fdec5ede1cd00b8308c4b58afaf2ff2cdaa171d417db879faa134d9c24333
SSDEEP

98304:fnn3XN3ddLTVGu37y1YqtkGLPblT0HjTAU2mioq1C9:fnn3NYu37/qGGLPbeDMlQ9

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0032000000013a88-9.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2924-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/memory/2924-1-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/files/0x0032000000013a88-9.dat	upx
behavioral1/memory/2924-12-0x0000000004FC0000-0x000000000505F000-memory.dmp	upx
behavioral1/memory/2924-154-0x0000000004FC0000-0x000000000505F000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe
2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2548	2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe	28
PID 2924 wrote to memory of 2548	2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe	28
PID 2924 wrote to memory of 2548	2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe	28
PID 2924 wrote to memory of 2548	2924	74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe	28

C:\Users\Admin\AppData\Local\Temp\74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe
"C:\Users\Admin\AppData\Local\Temp\74e9a46a1b8289d698cf5edf43a2f2e0b6b9dcd552af627e1f9bc0968f8574a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\cacls.exe
  cacls "" /e /p everyone:n
  2⤵
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f760973.tmp\data.ini

Filesize
1KB

MD5
f92e311c5135ff50818edb6d3a38de66

SHA1
c9d369ef3854fbd13a6204bd25981582d3200030

SHA256
034c6c33f3ccdbfe0de9760076c25f5456036a386c8549c5dfbc36174e990f37

SHA512
ae397f3da9497dcccc1e5d93a9b3ca8f8f9d803dd8a63c4c04771315449bd5f4416a9aae9b69f1c110e4c743095b125f3153db6f73ec8a243ca62e5a6cd91a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\f760973.tmp\data.ini

Filesize
2KB

MD5
2f0071056345a682cc38c4fd3222d485

SHA1
5799a45b0b6b765740291f32aca28e5f77bee413

SHA256
9d45f28f3fb32b9aefee84bcb35ef3f1ed215975fe5d2844620d4711dedf6e13

SHA512
b971af77832c1c6267b614f1bb14898f827b2d897722ea77c966073679e1d44e68487cb554de0da798bbe1bbf94318a0e853c7dcfb27d64bbe8289dcfc71d1ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\f760973.tmp\variable.ini

Filesize
761B

MD5
21fa746f8d554d0f4fd1257bb77fed19

SHA1
ef818ec6f9d54b9df90fc1e18fe795f76b22e0de

SHA256
f9834c6a2bde77599fc0df69d74d020d12b865de31176a48ad4404809ead8379

SHA512
cb6c743b07f31ec5611ef332de1b4fdd1f874a2cb024b5a359226df53616b5f329a72b896b8be4f8292d43bc563115ecc9fd35a697f050c17cbb7392dabaf4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\k.ico

Filesize
4KB

MD5
9cfb08886e6359a0746c4660e5ca7ec9

SHA1
3ecad689e4c0ae36c11942340224b7a1512db8c0

SHA256
69d39dda7328cd9b861cca82a592ea5c04ec418d8515abde58298954923afc14

SHA512
16c8e81718b0732697eca0a702fdc437cb79ccf3066b9ee412227677f8a8162ff7ebf704af682f667de1ebaaadea4a6d0b2efcfac871042a2c783c5c3e96ab75

Download Submit
\Users\Admin\AppData\Local\Temp\7-zip32_2.dll

Filesize
233KB

MD5
ea3df059beae86a3e186b2b179755e77

SHA1
babdcd6b5082c02fa2f5ebc2020f2cb3bbd77e8d

SHA256
1ab68a0c296281437fe638c8535309c6241ded4852608d940f5efcb8cc2d91a6

SHA512
1406d8083cfbd26e18aba74f6b45a09137bb3960f7afce5c5d0d790b0edb7277b7b885ed2ded9def12b667bcb37cbfb335884b2d7b8f08565743b674d1f053bb

Download Submit
memory/2924-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2924-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2924-5-0x000000007554D000-0x000000007554E000-memory.dmp

Filesize
4KB

Download
memory/2924-12-0x0000000004FC0000-0x000000000505F000-memory.dmp

Filesize
636KB

Download
memory/2924-11-0x0000000075520000-0x0000000075630000-memory.dmp

Filesize
1.1MB

Download
memory/2924-154-0x0000000004FC0000-0x000000000505F000-memory.dmp

Filesize
636KB

Download