Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 00:45
Behavioral task
behavioral1
Sample
Acunetix Premium Activation Tool.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Acunetix Premium Activation Tool.exe
Resource
win10v2004-20220718-en
General
-
Target
Acunetix Premium Activation Tool.exe
-
Size
6.2MB
-
MD5
0537e883d76c11df03adfe93ae6d5500
-
SHA1
f3090d8e68e8c35ed7e35a862759e3f444f0320c
-
SHA256
24354524397121389a297ac8a7c1af8b7d3fd9f9caf6f21975557b6d0e531091
-
SHA512
1f44e1acb1a1b66ca988f8233f10fc531c1f71303856ac9e442cc7f950894b8da37e40a89c99bd8cf1f27a85148033ef8bc1068060d6e5a052e60e64010f8380
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Acunetix Premium Activation Tool.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Acunetix Premium Activation Tool.exe -
Drops file in Drivers directory 2 IoCs
Processes:
Acunetix Premium Activation Tool.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts Acunetix Premium Activation Tool.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Acunetix Premium Activation Tool.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Acunetix Premium Activation Tool.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Acunetix Premium Activation Tool.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Acunetix Premium Activation Tool.exe -
Processes:
resource yara_rule behavioral1/memory/1056-55-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-57-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-58-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-59-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-60-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-61-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-62-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-63-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-64-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-71-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida behavioral1/memory/1056-95-0x000000013F0D0000-0x000000013FF65000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Acunetix Premium Activation Tool.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Acunetix Premium Activation Tool.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1056-58-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-59-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-60-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-61-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-62-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-63-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-64-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-71-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe behavioral1/memory/1056-95-0x000000013F0D0000-0x000000013FF65000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Acunetix Premium Activation Tool.exepid process 1056 Acunetix Premium Activation Tool.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A45B941-07C5-11ED-A4FC-CA554DF106CD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5A45B943-07C5-11ED-A4FC-CA554DF106CD}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Acunetix Premium Activation Tool.exepid process 1056 Acunetix Premium Activation Tool.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
Acunetix Premium Activation Tool.exeiexplore.exepid process 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1276 iexplore.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
Acunetix Premium Activation Tool.exepid process 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe 1056 Acunetix Premium Activation Tool.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1276 iexplore.exe 1276 iexplore.exe 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Acunetix Premium Activation Tool.execmd.exenet.execmd.exenet.execmd.exeiexplore.exedescription pid process target process PID 1056 wrote to memory of 964 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1056 wrote to memory of 964 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1056 wrote to memory of 964 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 964 wrote to memory of 1540 964 cmd.exe net.exe PID 964 wrote to memory of 1540 964 cmd.exe net.exe PID 964 wrote to memory of 1540 964 cmd.exe net.exe PID 1540 wrote to memory of 1508 1540 net.exe net1.exe PID 1540 wrote to memory of 1508 1540 net.exe net1.exe PID 1540 wrote to memory of 1508 1540 net.exe net1.exe PID 1056 wrote to memory of 1560 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1056 wrote to memory of 1560 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1056 wrote to memory of 1560 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1560 wrote to memory of 1712 1560 cmd.exe net.exe PID 1560 wrote to memory of 1712 1560 cmd.exe net.exe PID 1560 wrote to memory of 1712 1560 cmd.exe net.exe PID 1712 wrote to memory of 1504 1712 net.exe net1.exe PID 1712 wrote to memory of 1504 1712 net.exe net1.exe PID 1712 wrote to memory of 1504 1712 net.exe net1.exe PID 1056 wrote to memory of 620 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1056 wrote to memory of 620 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 1056 wrote to memory of 620 1056 Acunetix Premium Activation Tool.exe cmd.exe PID 620 wrote to memory of 1276 620 cmd.exe iexplore.exe PID 620 wrote to memory of 1276 620 cmd.exe iexplore.exe PID 620 wrote to memory of 1276 620 cmd.exe iexplore.exe PID 1276 wrote to memory of 1248 1276 iexplore.exe IEXPLORE.EXE PID 1276 wrote to memory of 1248 1276 iexplore.exe IEXPLORE.EXE PID 1276 wrote to memory of 1248 1276 iexplore.exe IEXPLORE.EXE PID 1276 wrote to memory of 1248 1276 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Acunetix Premium Activation Tool.exe"C:\Users\Admin\AppData\Local\Temp\Acunetix Premium Activation Tool.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C net stop Acunetix2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop Acunetix3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Acunetix4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C net start Acunetix2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet start Acunetix3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start Acunetix4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://www.Dr-FarFar.com/2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.dr-farfar.com/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/620-73-0x0000000000000000-mapping.dmp
-
memory/964-65-0x0000000000000000-mapping.dmp
-
memory/1056-64-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-56-0x0000000076CE0000-0x0000000076E89000-memory.dmpFilesize
1.7MB
-
memory/1056-58-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-59-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-60-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-61-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-62-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-63-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmpFilesize
8KB
-
memory/1056-57-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-96-0x0000000076CE0000-0x0000000076E89000-memory.dmpFilesize
1.7MB
-
memory/1056-95-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-55-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1056-72-0x0000000076CE0000-0x0000000076E89000-memory.dmpFilesize
1.7MB
-
memory/1056-71-0x000000013F0D0000-0x000000013FF65000-memory.dmpFilesize
14.6MB
-
memory/1504-70-0x0000000000000000-mapping.dmp
-
memory/1508-67-0x0000000000000000-mapping.dmp
-
memory/1540-66-0x0000000000000000-mapping.dmp
-
memory/1560-68-0x0000000000000000-mapping.dmp
-
memory/1712-69-0x0000000000000000-mapping.dmp