Overview

overview

7

Static

static

3

bd68fc985b...7N.exe

windows7-x64

7

bd68fc985b...7N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2024 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd68fc985b4909b2bd203be78325ea724a50b7d6b02e5453a6fdbd3923d6ea17N.exe

  • Size

    468KB

  • MD5

    fd2076f544be805bca9f4b3825ba0e10

  • SHA1

    c7a79ebb429cf1f30b49b87f21cc69b86b1e7d4f

  • SHA256

    bd68fc985b4909b2bd203be78325ea724a50b7d6b02e5453a6fdbd3923d6ea17

  • SHA512

    bbf7608d8454f15c823757a7d3e3db686bdc61cd2b512342bcc391b2c19ad80008deb5eada4c5a309daa3a5866202a5879cfbaca6d4ec4e08d70c32a7a567f5d

  • SSDEEP

    12288:yhClC8WGvjPJYo4yV2UoWUOAhY6fUHcxRNq93LZrS:TNQHY1

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Drops file in System32 directory 27 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd68fc985b4909b2bd203be78325ea724a50b7d6b02e5453a6fdbd3923d6ea17N.exe
    "C:\Users\Admin\AppData\Local\Temp\bd68fc985b4909b2bd203be78325ea724a50b7d6b02e5453a6fdbd3923d6ea17N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cyxZH.exe.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cyxZH.exe.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 532
        3⤵
        • Program crash
        PID:2768
      • C:\Users\Admin\AppData\Roaming\1.exe
        C:\Users\Admin\AppData\Roaming\1.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\System32\notepad.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3232
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3244
        • C:\Windows\SysWOW64\L88Tj.com
          C:\Windows\system32\L88Tj.com
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\SysWOW64\notepad.exe
            "C:\Windows\System32\notepad.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2604
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4844
          • C:\Windows\SysWOW64\75u6L.pif
            C:\Windows\system32\75u6L.pif
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1892
            • C:\Windows\SysWOW64\notepad.exe
              "C:\Windows\System32\notepad.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5024
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
              6⤵
              • System Location Discovery: System Language Discovery
              PID:948
            • C:\Windows\SysWOW64\X0Cuad5vL.cmd
              C:\Windows\system32\X0Cuad5vL.cmd
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4644
              • C:\Windows\SysWOW64\notepad.exe
                "C:\Windows\System32\notepad.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4868
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2348
              • C:\Windows\SysWOW64\75u6L.exe
                C:\Windows\system32\75u6L.exe
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1396
                • C:\Windows\SysWOW64\notepad.exe
                  "C:\Windows\System32\notepad.exe"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4272
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3300
                • C:\Windows\SysWOW64\75u6L.pif
                  C:\Windows\system32\75u6L.pif
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:548
                  • C:\Windows\SysWOW64\notepad.exe
                    "C:\Windows\System32\notepad.exe"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1604
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3352
                  • C:\Windows\SysWOW64\L88Tj.bat
                    C:\Windows\system32\L88Tj.bat
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2272
                    • C:\Windows\SysWOW64\notepad.exe
                      "C:\Windows\System32\notepad.exe"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:372
                    • C:\Windows\SysWOW64\regsvr32.exe
                      regsvr32 /s "C:\Windows\system32\mswinsck.ocx"
                      10⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:1412
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2924 -ip 2924
    1⤵
      PID:2044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\1.bat
      Filesize

      113B

      MD5

      30fb8674b40c1dc7958909ba1584b37e

      SHA1

      d35c5a768c6e655175571c4bfe3c485e24d47f2e

      SHA256

      11e9fcb10ce29674d8bf41ca773837207427409f108c01c882cfe21427c7dbed

      SHA512

      63049a21a3bb72795c247400350a2f84c00db8def7cecd7a800e0a9280b622fda4f259bfe4cbde2a6f3cf200973d5dfda838479f76a20d5a5d50b697413bdd9e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\1.bat
      Filesize

      99B

      MD5

      2353e539871b0e6efa1d04cc29104196

      SHA1

      219bc012cf372650a17fa5cc1a1f559351da75ec

      SHA256

      c918a00cebae43ef4701c0f10e8e00338ddaedcd3a693d0da57eeaaf62881ce5

      SHA512

      d40f0a4606967c28acdceff6431dd64c8a0ae7bc5d4655b06189269210090d8b96f009b6f958a8d179a8e76b15822baeb8f8ac7c0b78a7cdaa71a62e0deef883

      Download Submit

    • C:\Users\Admin\AppData\Roaming\1.bat
      Filesize

      99B

      MD5

      75bc9ef208dd266846e97001bb9751ab

      SHA1

      92e95ee4db926db4251a4be2363178de04a1f79d

      SHA256

      40898c4e3baf74cbbaa9d3cf19c2488e738059baf9cc506b6f6a594f47a7bd46

      SHA512

      a8faaa13d664b2805d7fd94e08ce3c68a6403aa4c6b55f2327dbc571fb95468a5433d66040423898d2aca6726f7a0c7d846e0d888ee03599ed639a5ab294c566

      Download Submit

    • C:\Users\Admin\AppData\Roaming\1.bat
      Filesize

      107B

      MD5

      2a3aee287dff9493512268a2b76676b2

      SHA1

      642e17c818d50e6871aa757363c612977dc62a3e

      SHA256

      e598353ab6679740a2cdfda60774cf2f2a6263f01fac63dcbcb482a565ffebdd

      SHA512

      fd24da0f941422069b2c34d22955e18dd68a55e19065ee3097f4e04640c988ee9d9c41742c9bee163dcaddf3023185f8f30cefd10e1cc5d1b7dcd60d8b6ba3de

      Download Submit

    • C:\Users\Admin\AppData\Roaming\1.bat
      Filesize

      99B

      MD5

      65a04afc69576fd7c76a3cdd4696eb92

      SHA1

      f678a90985a9bc23ba52f512e8ba24b92863c122

      SHA256

      5ea7cac65deed0f05251476f3b74a179917bc94faab006cb43a4a764d5b569e6

      SHA512

      995507d2044f71ceccabcd6a6824ba955a1c1936a306c22058a9aa1801ac88faedcb61b6c1ac74dfd2f371d61598ad96b944f2a67353fb74d3934762bfe468a6

      Download Submit

    • C:\Users\Admin\AppData\Roaming\1.exe
      Filesize

      150KB

      MD5

      039509d5bcce2de83eb176a8f05158b8

      SHA1

      e84d4874d16cf72dd153cf7522d1bc5356bf22ce

      SHA256

      8f522b179dc7b2e9afd7cf34188e7eea000dc6daebbcec7f456b0e101794e3e1

      SHA512

      dd3f8c482be619e155806b17df145d222729eed7687b36f1b611a1fd87a52b81e6e5b2abe4aa64899c1890f4cedea76d4f8b0ef7557d3836528e704de788b563

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cyxZH.exe.exe
      Filesize

      168KB

      MD5

      dc6bf6458b421a66acb6bf04e268f077

      SHA1

      2e4b2430c2f649bdc1eabd94509a1f3f5aeea902

      SHA256

      5b7056c0b7da879e983adf7be0c5fd3818ba647c06b73b20a5a8951315e9cfca

      SHA512

      9ae6fff466d8a999ad3438f60b9003d2dfb4d8625cb0c44395a729a62773509ee53489db09ddb81778817bb706b4374976a1b60a03adb99a763ce05fb18c1569

      Download Submit

    • C:\Users\Admin\AppData\Roaming\kernel33.dll
      Filesize

      625KB

      MD5

      358611b92e360a749054fdc7b6b076ea

      SHA1

      d6d2224161fee024ab3767a81ed57f7e57d0c1ce

      SHA256

      79782a87dfd093a0e4196d6f0aa4d46a55c0290f6145f5f8fa60e53c540f89b4

      SHA512

      0986c84ed52b42b3aeb96479032e188165d1fa1d5c7018e240b444e03eb6317365ea51fc0233263f7e97f099cd3ca3094ab0b177c0405816bc800b41f42523ad

      Download Submit

    • C:\Windows\SysWOW64\mswinsck.ocx
      Filesize

      105KB

      MD5

      9484c04258830aa3c2f2a70eb041414c

      SHA1

      b242a4fb0e9dcf14cb51dc36027baff9a79cb823

      SHA256

      bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

      SHA512

      9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

      Download Submit

    • C:\Windows\SysWOW64\zlib.dll
      Filesize

      27KB

      MD5

      200d52d81e9b4b05fa58ce5fbe511dba

      SHA1

      c0d809ee93816d87388ed4e7fd6fca93d70294d2

      SHA256

      d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617

      SHA512

      7b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5

      Download Submit

    • memory/548-102-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/548-118-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/1320-0-0x00007FFD49285000-0x00007FFD49286000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1320-14-0x00007FFD48FD0000-0x00007FFD49971000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1320-4-0x00007FFD48FD0000-0x00007FFD49971000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1320-2-0x000000001B970000-0x000000001BA16000-memory.dmp

      Filesize

      664KB

      Download

    • memory/1320-1-0x00007FFD48FD0000-0x00007FFD49971000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1396-101-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/1892-75-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-138-0x0000000010000000-0x0000000010014000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2272-147-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-157-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-116-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-155-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-153-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-130-0x0000000010000000-0x0000000010014000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2272-127-0x00000000033E0000-0x0000000003407000-memory.dmp

      Filesize

      156KB

      Download

    • memory/2272-151-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-135-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-136-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-149-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-139-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-141-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-143-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2272-145-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2924-12-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/2924-35-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/4160-59-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/4472-30-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/4472-46-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download

    • memory/4644-89-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

      Download