Analysis

  • max time kernel
    91s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 03:28

General

  • Target

    Photoshop-2023-Windows-25-0-es.exe

  • Size

    2.9MB

  • MD5

    2324572a1a166f0b57c4c55df94785f3

  • SHA1

    1a0bcaf4609b4e2a7a31e7b99362ea38af5b0c65

  • SHA256

    290c4ccc0839e6fcbe34492ca1b916431085f0b5fa2277ff227d0dcd9c2f88df

  • SHA512

    4a8eedff66a352ffa1be37a6d4fc84f2d4101dc3d241fcd64b310a767fc111436e583f7089585bbc1928fc7847c4a9f8665029bbd34b4192dd90cf01d658d9a8

  • SSDEEP

    49152:KdWYPac45TExljXrGGCzCWaUtqMbi6m9NGmVRD1sBA+wm+InK2vEo58WH0MdD:KdWjAxljXiGCGW9tbbQVRp9xm+yKtW84

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Photoshop-2023-Windows-25-0-es.exe
    "C:\Users\Admin\AppData\Local\Temp\Photoshop-2023-Windows-25-0-es.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 1864
      2⤵
      • Program crash
      PID:4000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1296 -ip 1296
    1⤵
      PID:3212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\{936191FC-9CEA-408C-887F-4E71B7337F91}\CCDInstaller.js

      Filesize

      1.2MB

      MD5

      e96bb3da47f4a3319b80f23051bdeb16

      SHA1

      c9913b052c5c7a59e100fe18357fddc1023161ea

      SHA256

      d69d7e68a706c60146a5b530368d7818599dbd39d071f181963a89945cff3c29

      SHA512

      6ac5bcdcdd2c70cb5094a6c985a81df520a6cf9f622c0697e00c0e3e4081cdb967f3da9df2a04072552dff2f70c43c9e84c2b6f3bf81f3720983859dff46f56e

    • C:\Users\Admin\AppData\Local\Temp\{936191FC-9CEA-408C-887F-4E71B7337F91}\index.html

      Filesize

      426B

      MD5

      a28ab17b18ff254173dfeef03245efd0

      SHA1

      c6ce20924565644601d4e0dd0fba9dde8dea5c77

      SHA256

      886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

      SHA512

      9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

    • memory/1296-0-0x00000000008E0000-0x0000000001232000-memory.dmp

      Filesize

      9.3MB

    • memory/1296-36-0x00000000008E0000-0x0000000001232000-memory.dmp

      Filesize

      9.3MB