d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe
Size

182KB
MD5

6e466bd51a46678ad515defd5e3ebd5a
SHA1

17fb1f12c125df98e6abc35b093e549e32bcac97
SHA256

d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7
SHA512

957f77df618227a716805c294b019fa2214af9c53f3172f761d06cd0e7cbd65d0c3802f383d4faad5c822d791d2a5ab68a87ea7f939e6513478c735d344a680e
SSDEEP

3072:ze3DM17EL+Zq29/fpvKB2e2jrHHp1EED14akBVWV5x7jFUO/pRvCHG3Dz:ze3DswLn2PI2xrHFD1fk6VbfFz/pxCuH

Score

9^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000022e2f-132.dat	acprotect
behavioral2/files/0x0009000000022e2f-133.dat	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4920-134-0x0000000031420000-0x000000003142B000-memory.dmp	upx
behavioral2/memory/4920-136-0x0000000031420000-0x000000003142B000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
4920	d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe
4920	d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rfuqlnnq.exe"	d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe

C:\Users\Admin\AppData\Local\Temp\d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe
"C:\Users\Admin\AppData\Local\Temp\d4043c6a00f5552c4b000121c6faf30908fb1f217888b69826f854f7b1a9d4b7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\criB01B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\criB01B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/4920-134-0x0000000031420000-0x000000003142B000-memory.dmp

Filesize
44KB

Download
memory/4920-135-0x00000000009B0000-0x0000000000A23000-memory.dmp

Filesize
460KB

Download
memory/4920-136-0x0000000031420000-0x000000003142B000-memory.dmp

Filesize
44KB

Download
memory/4920-137-0x00000000009B0000-0x0000000000A23000-memory.dmp

Filesize
460KB

Download