2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Size

237KB
MD5

f12f4efa10ffa56f032a5dca01c354d0
SHA1

f1de33699675f75f44f4a9883671b6714a72320f
SHA256

2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3
SHA512

93c2e0b6deeac2a6a197e1b6f576153ae79d40142cd1382db25be8b9a1d2299cc1069f41fdc75e1d0c48aeb7f82b6445e0fa391479bad2cec2be92eabb1a5b83
SSDEEP

3072:l1Upt1DlS2KyYzDhLrLeBdVw9+TpFLMHb+lXpQK5:CYzdLQa8z0yQQ

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000186c2-6.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2208	winlogon.exe

Loads dropped DLL 3 IoCs

pid	Process
1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/files/0x000e000000012262-9.dat	upx
behavioral1/memory/2208-20-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/memory/1992-19-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/memory/1992-11-0x0000000000220000-0x0000000000260000-memory.dmp	upx
behavioral1/memory/1992-8-0x0000000000220000-0x0000000000240000-memory.dmp	upx
behavioral1/files/0x00060000000186c2-6.dat	upx

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\T:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\J:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\M:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\U:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\L:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\R:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\P:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\V:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\E:	winlogon.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\N:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\O:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\V:	winlogon.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\E:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\Q:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\I:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\K:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\G:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\H:	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\N:	winlogon.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DIWTWB.dll	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File opened for modification	C:\Windows\SysWOW64\DIWTWB.dll	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
File created	C:\Windows\SysWOW64\MLS.dll	winlogon.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\EFile = "050044093052045078087045049038104112019066183176201006154021052230212245169184106062017026099086198044081039129025131144032"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ = "C:\\Windows\\SysWow64\\DIWTWB.dll"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ThreadingModel = "Apartment"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\DFile = "051038071052045073110211049038101122048066157128064207015175027157135063145005163198045162227091072105191082195167007095227158064"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DIWTWB.ShellExecuteHook1005\ = "Maihook1005"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DIWTWB.ShellExecuteHook1005\Clsid	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ = "Maihook1005"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DIWTWB.ShellExecuteHook1005	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DIWTWB.ShellExecuteHook1005\Clsid\ = "{4D65F220-63CA-11D8-9BDB-FD58F515A839}"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID\ = "DIWTWB.ShellExecuteHook1005"	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
2208	winlogon.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2208	1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe	30
PID 1992 wrote to memory of 2208	1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe	30
PID 1992 wrote to memory of 2208	1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe	30
PID 1992 wrote to memory of 2208	1992	2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe	30

C:\Users\Admin\AppData\Local\Temp\2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe
"C:\Users\Admin\AppData\Local\Temp\2dedc6c3c6677be5f937a5ea8e8ab328f1e39f0c9ec5db0329718472a32132e3N.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\$Recycle.Bin\winlogon.exe
  C:\$Recycle.Bin\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\$Recycle.Bin\winlogon.exe

Filesize
237KB

MD5
728070a9ae1b237886d9c6656056c37f

SHA1
3e728cc61dbaa210bd6a922dc8984e0fa06b8aa6

SHA256
676efcbe3796212da68a9203972554be8ff87401e3fffde0bf45d9013e61e4df

SHA512
281f29b6a662c34124a611eb46e53ce9abc0fc3adcf2a220029766237c1426e55df81f44de5745f967eccee6f11397c74040dfa724240edf0d48dba7ee9b5015

Download Submit
\Windows\SysWOW64\DIWTWB.dll

Filesize
284KB

MD5
c23974b83d6a53bb42e38105892c4ab2

SHA1
afb80d4afb6c2cac3de4b0dd52b5e7a7ac9cabe7

SHA256
1ab13f40b2191ab62715c0759309a4198fc0a0a47f1d444a226eaf84e8f30912

SHA512
dba21d6c0f01115b1a75cd79937155086b08a1e0bf634f3a8c1a3ed2586c0802da05bc8231a6489a146f4c55e63903f33e6803434903d753948baca49d58d68d

Download Submit
memory/1992-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1992-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1992-17-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1992-11-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/1992-8-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/2208-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download