9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
Size

600KB
MD5

a3cce88439caab028877200299fcd213
SHA1

347db76c05334cec97c6bef58eae81b943d5ae07
SHA256

9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d
SHA512

abc23ac4712b07ac8c43e1a8130a6ad28e0cefa56fd59615d2b0f118aa81e287b57d29bf43289c97e2a0f0e964593759be1d956e0edf7a97c19b3582afadc820
SSDEEP

1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRqm:352T3siXei5bcmP9JfUjWU

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000019504-6.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2732	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe"	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 9.x Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\mIRC 6.x Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.x.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\MusicMatch Jukebox 8.0 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Lord of the Rings - War of the Ring No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman II No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Lords of EverQuest Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Unreal Tournament 2004 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Rainbow Six 3 - Raven Shield Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman 3 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Neverwinter Nights - Shadows of Undrentide No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\ICUII 5.7 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Lords of the Realm III No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Silent Hill 3 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Adobe Photoshop 8.x Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.x Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Star Trek - Elite Force II No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NCAA Football 2004 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Network Cable e ADSL Speed 1.0.6 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Silent Hill III No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SnagIt 6.2.2 Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Counter-Strike - Condition Zero Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Half-Life II No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Chrome Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\PhotoShow 2.x Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Etherlords II No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Thief 3 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\FlashFXP 1.x Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2002 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Freedom - Soldiers of Liberty No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Thief 2 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinRAR 3.11 Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warcraft III - The Frozen Throne Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Warlords 4 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Internet Turbo 2003 5.4 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\SimCity IV Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\EverQuest 2 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Soul Reaver 3 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Quake IV No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 9.x Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman 3 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman 3 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Quake 4 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8x Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Chrome No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman III Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\WinRAR 3.12 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\WinZip 8.0 Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\GetRight 5.x Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Delta Force - Black Hawk Down No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Hitman II No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\MechWarrior 3 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Tiger Woods PGA TOUR 2002 No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Adobe Photoshop 7.x Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File created	C:\Windows\SysWOW64\drivers32\Hitman II Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\WinZip 8.1 Serial Generator.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\Harry Potter - Quidditch World Cup No-Cd Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
File opened for modification	C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.x Crack.exe	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2732	1828	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe	31
PID 1828 wrote to memory of 2732	1828	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe	31
PID 1828 wrote to memory of 2732	1828	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe	31
PID 1828 wrote to memory of 2732	1828	9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe	31

C:\Users\Admin\AppData\Local\Temp\9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe
"C:\Users\Admin\AppData\Local\Temp\9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\$$$$$.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$$$$$.bat

Filesize
264B

MD5
2632bcb17fa40d750e9dd909357b5eda

SHA1
8819d608c136f56c4658b134d7da704d7fabba28

SHA256
b0d4c3b482c88f6b5b1182cecf1bd18364685dd02b925c5900ef381a637c1dbf

SHA512
352f2ce77228ba3b0f04bf7d54af90b53e70a2b98fb763b92d61a75487bd75a1ee0f0a7a4a8c0165c619cb941280616e0da0a9a70d8899e6573d9ed0906126f0

Download Submit
C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

Filesize
600KB

MD5
a3cce88439caab028877200299fcd213

SHA1
347db76c05334cec97c6bef58eae81b943d5ae07

SHA256
9c306fc3c46f6646e3b8cbbaf734f92f289fbef8fc9ea9a4296048a3882e8a1d

SHA512
abc23ac4712b07ac8c43e1a8130a6ad28e0cefa56fd59615d2b0f118aa81e287b57d29bf43289c97e2a0f0e964593759be1d956e0edf7a97c19b3582afadc820

Download Submit
memory/1828-3-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1828-536-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1828-826-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads