Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 15:23

General

  • Target

    点击此处安装语言包.exe

  • Size

    10.8MB

  • MD5

    44ce97dc5b3054dfb4999933219887b7

  • SHA1

    23cedb5e66fbc1cf3c86a8812d6189ed3dd88b17

  • SHA256

    af884204ca0845632eb01c3a37a9d5609f2b7065b884500658da60080eaab617

  • SHA512

    e602db55a559e6c8f96d8dc222af5debc0025675d6fcf8e98e89d4efbd65811819d1e6c8c3467576b850ceb25e0891edb1b648e130caf66046fbc643a584ae04

  • SSDEEP

    196608:PB/vhOCUMgKCZFB4IS+9G0eBF/6FLOyomFHKnPdfxxEBB2XCQkfLoaxA4JN1cdDD:PdJOCdgxZFBVeBUFqJbnf

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe
    "C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe
      C:\Users\Admin\AppData\Local\Temp\点击此处安装语言包.exe 47043E045804540476046B0463047604650469044004650470046504580460046104610474047704670465046A0458046C0434044A04540434045B04420443044F044004360453044E045804360436044F0431046D047C0437046304--aa`
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\22K5ix3g.exe
        "C:\ProgramData\deepscan\h0NP0_FGKD2WJ\22K5ix3g.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\22K5ix3g.exe

    Filesize

    2.4MB

    MD5

    7721777df2350ff195203cc7d7fe12c5

    SHA1

    a434eee80a389fef7f4d9886ec23bc7c8fcb2e64

    SHA256

    af3f9d480936286ce799ed5422222d3feabbc2325cb8242c2d09937964e73916

    SHA512

    e94d1dc08cc7dbf98e50f933adc94b37e96ae4738eaff4c62c4901e9a38e67bbaa316e8ee770497b44257c7bfeca6a5924294f980b54a9da049d074fa63c4d41

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\22K5ix3g.txt

    Filesize

    245B

    MD5

    83653858b21fb0c5759557da1d4bef6a

    SHA1

    e2b74867e669f0f5e84f4fb398ee8bdcc76d45f2

    SHA256

    ec02e0a0cdf6446da1a73267f8f7d5c544750fe96d01a97eb765e9187ed2eb72

    SHA512

    960b8ae0adefad0a155dd5f90c04f132877e26238aeaf9e6076608c50a4f5b584e5b3a1ef9eb1cfa363aef8e4eac80f43149f22d4e82a4c1bb16745b9bf31e2f

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\MSVCR120.dll

    Filesize

    948KB

    MD5

    034ccadc1c073e4216e9466b720f9849

    SHA1

    f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    SHA256

    86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    SHA512

    5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\mfc120.dll

    Filesize

    4.2MB

    MD5

    e1629a36f15824346bb54a9ebe9b622f

    SHA1

    ee5d55315ffb351e24b7c918c82e6ce4ec17a645

    SHA256

    68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d

    SHA512

    0301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\msvcp120.dll

    Filesize

    444KB

    MD5

    fd5cabbe52272bd76007b68186ebaf00

    SHA1

    efd1e306c1092c17f6944cc6bf9a1bfad4d14613

    SHA256

    87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

    SHA512

    1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\yGraphHlp180.dll

    Filesize

    186KB

    MD5

    feec59aca478ffd02bf81ec4a02768f1

    SHA1

    0a68219e91fd2f7a413b974a9ea22253ba9a6376

    SHA256

    c7d5fb1cdc4a2f6321c6e74538092a9ec6f2038d48c18132f77162b0064cd922

    SHA512

    23411c62d93b6107c1b3df2ee0ea7bfe62325483ecbc2653c17a66f6f5d4a1f2818b6be109f35b309d26d5733c379efbd2879d853e2c3f78b1ad4fc697c5a605

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\yclienti.dll

    Filesize

    255KB

    MD5

    fa9d7d6498f69a3f129555856b8e57d6

    SHA1

    ded693730bd80767884d78c522c9d8d0061958db

    SHA256

    3ab66b2fd3173e71318175f19908331d7e3b442b14d3e39f0f10014f64f716ad

    SHA512

    235bf1dfd22c6a30e8df6737218c7968901192907db2846a43684d006f4159e0b16a4ecb0a3e67217c33778924bb6e05b8a963fc148df33190e4ba41b119dd8c

  • C:\ProgramData\deepscan\h0NP0_FGKD2WJ\ygraph180.dll

    Filesize

    2.1MB

    MD5

    138e8d93a64d965565c7a521bfb4b83f

    SHA1

    7e9a41dcc64a50a8987c553212cf150b6f2a3bcb

    SHA256

    974e2266fe114abbc09e551ba230b10d25bdf5d5d1359f0814261ea48426f030

    SHA512

    06932c0813d102db66970c8794c6bd87bbb7b9627b650112f27545c3aba7fc481d0e4316293e126be6528d7f4a051f1ab6ea804bfcbfc60d61a8ef49361a1fa5

  • memory/2288-44-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-47-0x00000000732B0000-0x000000007334F000-memory.dmp

    Filesize

    636KB

  • memory/2288-35-0x00000000771D0000-0x00000000771D1000-memory.dmp

    Filesize

    4KB

  • memory/2288-33-0x0000000010000000-0x0000000010374000-memory.dmp

    Filesize

    3.5MB

  • memory/2288-36-0x0000000077490000-0x0000000077491000-memory.dmp

    Filesize

    4KB

  • memory/2288-37-0x0000000002F80000-0x0000000002F81000-memory.dmp

    Filesize

    4KB

  • memory/2288-38-0x0000000001610000-0x0000000001611000-memory.dmp

    Filesize

    4KB

  • memory/2288-39-0x0000000002F90000-0x0000000002F91000-memory.dmp

    Filesize

    4KB

  • memory/2288-40-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-41-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-43-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-31-0x0000000073470000-0x00000000734FD000-memory.dmp

    Filesize

    564KB

  • memory/2288-32-0x00000000732B0000-0x000000007334F000-memory.dmp

    Filesize

    636KB

  • memory/2288-45-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-46-0x0000000073470000-0x00000000734FD000-memory.dmp

    Filesize

    564KB

  • memory/2288-30-0x0000000010000000-0x0000000010374000-memory.dmp

    Filesize

    3.5MB

  • memory/2288-48-0x0000000010000000-0x0000000010374000-memory.dmp

    Filesize

    3.5MB

  • memory/2288-49-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-50-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-53-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-56-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-57-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-60-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-61-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-62-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-63-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-68-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-69-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-74-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-75-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-78-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB

  • memory/2288-79-0x0000000003C00000-0x0000000003CE7000-memory.dmp

    Filesize

    924KB