Analysis
-
max time kernel
152s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30/10/2022, 22:36
General
-
Target
e5a143b9d4dc8982cc825fd6048dab603ad4bc873eacef58df23380f00359015.exe
-
Size
2.5MB
-
MD5
833830b25db3a655ffbf2ed1ba7d91ca
-
SHA1
cdcf0442931512baad5e08cf31674d9228d37018
-
SHA256
e5a143b9d4dc8982cc825fd6048dab603ad4bc873eacef58df23380f00359015
-
SHA512
f10792ea14babc798893fc51e6acc1b085e2804e16409cd52e30641d45c5eb1d60881ca6bae98d3f4a79d7589cae44e76886fd70f2898851c31a393d1d8562d0
-
SSDEEP
49152:E3iO0bQZYX0gtKP4+5q1u6OxnYIEqSRsApwqDZDLb:E3iO0bCgv717idvgwcZb
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5a143b9d4dc8982cc825fd6048dab603ad4bc873eacef58df23380f00359015.exe"C:\Users\Admin\AppData\Local\Temp\e5a143b9d4dc8982cc825fd6048dab603ad4bc873eacef58df23380f00359015.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL "C:\Windows\NILLoa.cpl"2⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
1.9MB
MD55efe569accf794c26d03f574f77b62cb
SHA13d95b09b1d2585b7d5c370e08be92955da88770a
SHA256291a1b2fc21545199160fbdaab2b15b1a1920d6541ca38dbe3f7d95eb45cf2f0
SHA512937ce81afdc41e560e35ce1210955d862ef76d9e7de183ee42c3f9a2003e511d4b982a5448ef52efc9ef98e932f290837501ccf07db76fceba69eaebea02ebc7
-
Filesize
1.9MB
MD55efe569accf794c26d03f574f77b62cb
SHA13d95b09b1d2585b7d5c370e08be92955da88770a
SHA256291a1b2fc21545199160fbdaab2b15b1a1920d6541ca38dbe3f7d95eb45cf2f0
SHA512937ce81afdc41e560e35ce1210955d862ef76d9e7de183ee42c3f9a2003e511d4b982a5448ef52efc9ef98e932f290837501ccf07db76fceba69eaebea02ebc7
-
Filesize
460KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
460KB
-
Filesize
460KB