Analysis
-
max time kernel
152s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03/10/2022, 18:50
General
-
Target
f5801d0a6f7c9511b62333937e112a806a4a3a896231c1b6a02aacd55a7b2bbd.exe
-
Size
1.1MB
-
MD5
3661d0e0f33053ee54f42af4aab2f370
-
SHA1
c86b3011e0f3ca3aca3651a11da4f2e2a9c94939
-
SHA256
f5801d0a6f7c9511b62333937e112a806a4a3a896231c1b6a02aacd55a7b2bbd
-
SHA512
a72a02c3d74d5f8ae614142b7a7e550b2cce09fde8d56c8e9d5d8e2da4649f3c8a616160647694c9de58f5d278397658ad70d34e1a03d69ed0493fb64529fa86
-
SSDEEP
24576:E5ftxSucJw68CudUg59V8QYvSP0qtTEloR5Faeic3fG:AxTjfGg5gvaTeyiOfG
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5801d0a6f7c9511b62333937e112a806a4a3a896231c1b6a02aacd55a7b2bbd.exe"C:\Users\Admin\AppData\Local\Temp\f5801d0a6f7c9511b62333937e112a806a4a3a896231c1b6a02aacd55a7b2bbd.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD501db55dd0411367d5c5235ef0ea04d27
SHA15b54529acfa87e6a0794ea88d8cdfc3128e334c0
SHA256caadd1908cc566df9f5044751d6b66849e08757ade06ef1e7635ed04e652becd
SHA512ae40172a96b36d1effd328ff19ff72cad257f2c80cfaad808cd9e2ec753ec2c58d874a8d1af10a8e84e856da3d33a8fbfee165873e521c7dac7b87c7b81c9b6d
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
460KB
-
Filesize
1.2MB
-
Filesize
460KB