Analysis
-
max time kernel
99s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 04:56
Behavioral task
behavioral1
Sample
42457e393fee96921b534abab0b7a8c0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
42457e393fee96921b534abab0b7a8c0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
120 seconds
General
-
Target
42457e393fee96921b534abab0b7a8c0N.exe
-
Size
748KB
-
MD5
42457e393fee96921b534abab0b7a8c0
-
SHA1
bb347fedb681a929727740fa91acf307959a4b3f
-
SHA256
19b973d1989ae53b86002a269120959cb45e680c167daad09778448f1ff5bde0
-
SHA512
11f1f4668a9b6720f7c1bb53350202a1ef0396a0434bdb8f7d0bcbcd272db09fc474dc26483d99c4ec960eebe22b2ace5bd1f03005cf3d80ede40e02be3c7659
-
SSDEEP
1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRqm:352T3siXei5bcmP9JfUjWU
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0007000000023438-6.dat aspack_v212_v242 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SvcHosts32 = "C:\\Windows\\system32\\svchosts.exe" 42457e393fee96921b534abab0b7a8c0N.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein Enemy Territory Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 8.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior 3 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Alpha Communicator 5.0 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Need for Speed Underground No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Half-Life Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\MechWarrior 4 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\NetPumper 1.03 Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\WinAce 2.2 Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\LingoWare 3.0 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Star Wars Jedi Knight - Jedi Academy No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Madden NFL 2003 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Silent Hill III Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\NASCAR Thunder 2004 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Elder Scrolls III - Tribunal No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\FlashFXP 1.4 Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\DOOM 3 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior III Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinAce 2.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\MechWarrior 5 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\DOOM 3 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 9.x Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\NASCAR Racing 2003 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\NBA Live 2003 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Grand Theft Auto - Vice City Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Command & Conquer Generals No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\World War II - Frontline Command No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\UltraEdit-32 10.00b Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\DAP Plus 5.3 Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Paint Shop Pro 8.x Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Lord of the Rings - The Two Towers No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\SnagIt 6.2.2 Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Ad-aware 6.0 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\SWiSH 2.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Return to Castle Wolfenstein No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Nero Burning ROM 5.5.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\GetRight 5.x Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Midtown Madness 2 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Ulead PhotoImpact 8.x Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Hex Workshop Hex Editor 4.1 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\SolSuite 2003 Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Xenus Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\ICUII 5.7 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Adobe Photoshop 7.x Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\DOOM III Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Divx 5.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\The Sims Superstar No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Commandos 3 - Destination Berlin Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Metal Gear Solid 2 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Download Accelerator Plus 5.3 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Easy CD-DA Extractor 5.1 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\WinZip 9.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Sniper Elite - Berlin 1943 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\WS_FTP 5.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\NHL 2003 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\ZoneAlarm 3.8x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\Adobe Acrobat 5.x Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe File opened for modification C:\Windows\SysWOW64\drivers32\Tony Hawks Pro Skater 4 No-Cd Crack.exe 42457e393fee96921b534abab0b7a8c0N.exe File created C:\Windows\SysWOW64\drivers32\WinRAR 3.11 Serial Generator.exe 42457e393fee96921b534abab0b7a8c0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42457e393fee96921b534abab0b7a8c0N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1836 4796 42457e393fee96921b534abab0b7a8c0N.exe 98 PID 4796 wrote to memory of 1836 4796 42457e393fee96921b534abab0b7a8c0N.exe 98 PID 4796 wrote to memory of 1836 4796 42457e393fee96921b534abab0b7a8c0N.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\42457e393fee96921b534abab0b7a8c0N.exe"C:\Users\Admin\AppData\Local\Temp\42457e393fee96921b534abab0b7a8c0N.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\$$$$$.bat2⤵
- System Location Discovery: System Language Discovery
PID:1836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
748KB
MD542457e393fee96921b534abab0b7a8c0
SHA1bb347fedb681a929727740fa91acf307959a4b3f
SHA25619b973d1989ae53b86002a269120959cb45e680c167daad09778448f1ff5bde0
SHA51211f1f4668a9b6720f7c1bb53350202a1ef0396a0434bdb8f7d0bcbcd272db09fc474dc26483d99c4ec960eebe22b2ace5bd1f03005cf3d80ede40e02be3c7659
-
Filesize
202B
MD524d2efc267ece88673d4cb01f66e575c
SHA13aa71a943d6d3c1b48d056cedbcab4d87231030a
SHA2560d462e56c8209edbda831c8b4c317311717ed9da618c1f2b9e0754bbde099be1
SHA5123da694418489d0daae01fb457ec34ce3e33fd9b5a9f26a54de86c8f0a3f3f183824e9cd52c2fdd2c80c7adaf934d52f9bc48e252d0b149d66733dedf12d93cd2