General
Target

4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

Filesize

1MB

Completed

21-05-2022 00:24

Task

behavioral1

Score
10/10
MD5

58cf8209f97252b8126cf3ba13f6cb92

SHA1

954fddb2a43eef8f0a4f16d02e8599b2b2ea81fe

SHA256

4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe

SHA256

f6cb4a9aee03420c085b6e13fcdca5512512dc8cd7ceae4429e4a5140b6ba673b80f496b92c296a39879386e758a4ae27a0bf1a7462e2f3202f2cf64221d2e06

Malware Config
Signatures 12

Filter: none

Discovery
Persistence
  • suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    Description

    suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    Tags

  • ACProtect 1.3x - 1.4x DLL software

    Description

    Detects file using ACProtect software.

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x0007000000012718-55.datacprotect
  • Downloads MZ/PE file
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x0007000000012718-55.datupx
  • Loads dropped DLL
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Reported IOCs

    pidprocess
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Checks whether UAC is enabled
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    TTPs

    System Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Writes to the Master Boot Record (MBR)
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Description

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    TTPs

    Bootkit

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\PhysicalDrive04619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Modifies registry class
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "302687f198c0193af948af0cc1b0a486"4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\PacketPath_0_0_1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdb_semrjgj.dll"4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "742CC7051C47CD8A5906B4FEAB3B96BB"4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "9wo4xjfx2vmi2wcgy7ypgmkltzob"4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Suspicious behavior: EnumeratesProcesses
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Reported IOCs

    pidprocess
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Suspicious use of AdjustPrivilegeToken
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Suspicious use of FindShellTrayWindow
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Reported IOCs

    pidprocess
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
  • Suspicious use of SendNotifyMessage
    4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe

    Reported IOCs

    pidprocess
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    18084619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
    "C:\Users\Admin\AppData\Local\Temp\4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe"
    Loads dropped DLL
    Checks whether UAC is enabled
    Writes to the Master Boot Record (MBR)
    Modifies registry class
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:1808
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • \Users\Admin\AppData\Local\Temp\kdb_semrjgj.dll

                        MD5

                        cf20e3f69ae844fd027ce759f0aa560c

                        SHA1

                        2d5079bf74c4cdc226c605a9e82bd803ff577648

                        SHA256

                        f9cce6e4026f7be00fbf665bdc9e433baf0932ddf8bf660bcacbc61a4b44748a

                        SHA512

                        49dae81fe0b2a47c548674ec2dea8c4a9a956308daf6ee6a7448ec373ca07094e0d04cd9dc88c527778d91aa8b13ecd6045eddf60d79a8c061f9530ac1b70015

                      • memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp