Analysis
-
max time kernel
28s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-07-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
94ff4db57862654ab6d3c556ae03f533.exe
Resource
win7-20220414-en
General
-
Target
94ff4db57862654ab6d3c556ae03f533.exe
-
Size
377KB
-
MD5
94ff4db57862654ab6d3c556ae03f533
-
SHA1
6f052cd8cb59ae932bbe235a993c5e63a8aa078b
-
SHA256
33b4058adaed65e17b07ee1c11af2c1a53e65dbd98f86cdfc72d841529160c14
-
SHA512
83a0c02fe2211a8355584de69004f1edecbfdfb402c5c1955ad67ffe511bca5ddfa98410015926d1ef5c1de9e773ca4303c266da589a4f0c62fc51b0e83497c2
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\fdk1E3B.tmp acprotect -
Executes dropped EXE 1 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533Srv.exepid process 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533Srv.exe upx C:\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533Srv.exe upx C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\94FF4DB57862654AB6D3C556AE03F533SRV.EXE upx behavioral1/memory/1740-62-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533.exepid process 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe -
Drops file in Program Files directory 3 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 94ff4db57862654ab6d3c556ae03f533Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\px1FC1.tmp 94ff4db57862654ab6d3c556ae03f533Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 94ff4db57862654ab6d3c556ae03f533Srv.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533.exepid process 892 94ff4db57862654ab6d3c556ae03f533.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533.exepid process 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533.exe94ff4db57862654ab6d3c556ae03f533Srv.exedescription pid process Token: SeDebugPrivilege 892 94ff4db57862654ab6d3c556ae03f533.exe Token: SeTakeOwnershipPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeRestorePrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeBackupPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeChangeNotifyPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeTakeOwnershipPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeRestorePrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeBackupPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeChangeNotifyPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeTakeOwnershipPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeRestorePrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeBackupPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeChangeNotifyPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeTakeOwnershipPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeRestorePrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeBackupPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeChangeNotifyPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeTakeOwnershipPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeRestorePrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeBackupPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe Token: SeChangeNotifyPrivilege 1740 94ff4db57862654ab6d3c556ae03f533Srv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533.exepid process 892 94ff4db57862654ab6d3c556ae03f533.exe 892 94ff4db57862654ab6d3c556ae03f533.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94ff4db57862654ab6d3c556ae03f533.exedescription pid process target process PID 892 wrote to memory of 1740 892 94ff4db57862654ab6d3c556ae03f533.exe 94ff4db57862654ab6d3c556ae03f533Srv.exe PID 892 wrote to memory of 1740 892 94ff4db57862654ab6d3c556ae03f533.exe 94ff4db57862654ab6d3c556ae03f533Srv.exe PID 892 wrote to memory of 1740 892 94ff4db57862654ab6d3c556ae03f533.exe 94ff4db57862654ab6d3c556ae03f533Srv.exe PID 892 wrote to memory of 1740 892 94ff4db57862654ab6d3c556ae03f533.exe 94ff4db57862654ab6d3c556ae03f533Srv.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 368 892 94ff4db57862654ab6d3c556ae03f533.exe wininit.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 380 892 94ff4db57862654ab6d3c556ae03f533.exe csrss.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 416 892 94ff4db57862654ab6d3c556ae03f533.exe winlogon.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 464 892 94ff4db57862654ab6d3c556ae03f533.exe services.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 472 892 94ff4db57862654ab6d3c556ae03f533.exe lsass.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 480 892 94ff4db57862654ab6d3c556ae03f533.exe lsm.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 572 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 652 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 732 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 732 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 732 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe PID 892 wrote to memory of 732 892 94ff4db57862654ab6d3c556ae03f533.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533.exe"C:\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533Srv.exeC:\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\94FF4DB57862654AB6D3C556AE03F533SRV.EXEFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\94ff4db57862654ab6d3c556ae03f533Srv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\fdk1E3B.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
memory/892-60-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/892-61-0x0000000000440000-0x00000000004B3000-memory.dmpFilesize
460KB
-
memory/1740-56-0x0000000000000000-mapping.dmp
-
memory/1740-58-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/1740-62-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1740-63-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB