Analysis
-
max time kernel
28s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe
-
Size
1.0MB
-
MD5
7b61a85e0c90d55dd43ade8b52be16df
-
SHA1
1a2d96925537e178d32dc148823f8513fe5045f6
-
SHA256
f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096
-
SHA512
bc0a97bae758f5dea4391d69686c21d876e21f4239ab5c28663bb07ba34250d160078b86487ad6c9f345eec06746928774e5e520d42fccc3b8faa4aaaeb34a90
-
SSDEEP
24576:8kabsM8KGH7Co0OLeGrIocE5lArjPP1+LEvhtlFM:8k08KGbNLeGMb4un1+wv37M
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00140000000054ab-55.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\SET4184.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Windows\SysWOW64\msnphoto.scr f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Windows\SysWOW64\SET4184.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\TMP4352$.TMP f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4198.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\pidav.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4194.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4198.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\ActiveXControl.htm f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\SET4246.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41FF.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\unicows.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\images\SET4201.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\1033\SET4234.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4195.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\data.xml f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41A9.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\messengerData.xml f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\1033\SET4234.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\scripts\SET4222.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41A9.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\pi.inf f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\fngrprnt.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\images\prggrn.gif f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41DD.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\SET4235.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\1033\piorgres.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\msvcr71.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\SET4258.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\SET4259.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\TMP4352$.TMP f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41BB.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\msvcr71.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\images\mega.gif f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41DD.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41FF.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\images\SET4212.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\scripts\SET4222.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4197.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4197.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41CC.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\piorg.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\SET4235.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\SET4259.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41AA.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\pidav.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\scripts\Slideshow1.js f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\locale\slideshow.xml f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\images\SET4200.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\locale\SET4233.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\SET4245.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4194.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET4196.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41BC.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41DE.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\pisynctw.exe f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\TMP4352$.TMP f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\startup.js f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41CC.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\SET4257.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\SET41AA.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\PI\images\SET4201.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\SET4258.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\piview.dll f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File opened for modification C:\Program Files (x86)\MSN\MSNCoreFiles\PI\splash.gif f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\SET4245.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe File created C:\Program Files (x86)\MSN\MSNCoreFiles\SET4246.tmp f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe Token: SeRestorePrivilege 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2000 f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe"C:\Users\Admin\AppData\Local\Temp\f96bb7aa07f3344f135fe269982fc921134994b319c895d788ac1b744658d096.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD50ac28de5e930e8a52ad6b163c5473412
SHA125371c9d876959cb58b50c25ad709cf98dde45bb
SHA25606eed244d89f6e15205d5beb8085ac33c0de486dfe30eec9fb73b91de07e5f62
SHA512c2c82449927cac953668142a3f597c06626b0b3a26e8036de34e4ca1042a572fa3befa799d43fb24a1d23c821b5ed7994e3d211b6aaced15ba31d4639e96d877
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9