3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
Size

4.0MB
MD5

3c4510f89e7cefa5316dd0170809a5af
SHA1

3cff629e390af8a37ab0e82af2babab9ad6615d3
SHA256

3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870
SHA512

e5ec479ef6f3f7fb3e43e9c499930956e6fce136246ff0ef2ee563fbe54dc3052743c820c6df1ee5500aa96e011b3e6fb4f3e8f454cc6a282c599cc4e5cab2a8
SSDEEP

49152:rVxwJxin6ea59xUQoBkHcYJs993X+s8KuqGaX0ToIBAUZLYep:jKxinS9oBk8YJs92JBAUZL7

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2996-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-57-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-83-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-85-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-81-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-77-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-75-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-73-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-71-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-69-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-67-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-88-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2996-108-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-106-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-104-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-102-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-100-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-98-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-96-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-94-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-92-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-90-0x00000000035F0000-0x000000000362E000-memory.dmp	upx
behavioral1/memory/2996-89-0x00000000035F0000-0x000000000362E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2996	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunDll32.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	RunDll32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2124	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	30
PID 2996 wrote to memory of 2408	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	31
PID 2996 wrote to memory of 2408	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	31
PID 2996 wrote to memory of 2408	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	31
PID 2996 wrote to memory of 2408	2996	3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe	31

C:\Users\Admin\AppData\Local\Temp\3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe
"C:\Users\Admin\AppData\Local\Temp\3c56cb30624e9ca394ca44f0288d5d6052b15b3003d16535048b3fc7e0ecc870.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 2148
  2⤵
  - Program crash
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\FiddlerCore4.dll

Filesize
505KB

MD5
79fe5228b7ccdc88cf7ddba2893ea71f

SHA1
4313028e5354d66be81fd2103a16b16e1ad1a6f3

SHA256
5850d403352d76e7f7ebda93a7bff5ab1ea57c91a54a2f6c2cfaf1c9d356d55f

SHA512
f46380ccd2fcb8246206f176f17c1931d57c3bc1312c95e059cf9feab4bc392ad31fa6ffc6a1dac3b0bd70c5393ab1c2cf21729e357cb7c523d487dd92aacac3

Download Submit
\Users\Admin\AppData\Local\Temp\efd.dll

Filesize
38KB

MD5
82aff43dea5b7e114cb75f1a9c625b9a

SHA1
744f47a54429f23f49a36b45f7bd376d78110f36

SHA256
d5bcdb257b09fcf88e616206a17c9d65864ec1bcbf81b79ffcfd971fbd6f0f19

SHA512
8860c4fa405bd921d65241959218ba840a6ca8ec3fc9f3cd222bfd14edda073591f7323ae6e69c19a1e2d3beb39a9e1f3b52f19160f269dfa7ff78e7f600c65c

Download Submit
memory/2996-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-89-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-83-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-85-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-81-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-77-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-75-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-73-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-69-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-67-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-195-0x0000000007A80000-0x0000000007B02000-memory.dmp

Filesize
520KB

Download
memory/2996-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-71-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-88-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-108-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-106-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-104-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-102-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-100-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-98-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-96-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-94-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-92-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-90-0x00000000035F0000-0x000000000362E000-memory.dmp

Filesize
248KB

Download
memory/2996-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-186-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/2996-190-0x0000000007750000-0x000000000775E000-memory.dmp

Filesize
56KB

Download
memory/2996-191-0x00000000746E0000-0x00000000746EE000-memory.dmp

Filesize
56KB

Download
memory/2996-57-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2996-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download