Analysis
-
max time kernel
266s -
max time network
348s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
dbwmdjs_dtf.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
dbwmdjs_dtf.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
dbwmdjs_dtf.exe
-
Size
2.4MB
-
MD5
6513311f73feccd7f1b6475c17e5b531
-
SHA1
7427ab5cba88979baaf42867828623a97e902455
-
SHA256
de7c6857fecc81141b3aa01fd9a3f30e0ad63c8352a4265688fa1d74817fffba
-
SHA512
23f6406e5f8d346e6938bf7f2a8e0f9b910071b5f9d44e1fa5a42787820322f4fa62c15d7a259941671754ba1c1a49b5ad79379419bc8d7943a9bb4ddef2bd99
-
SSDEEP
49152:Ueixv5gjv451U21sZCg1ch16FRU1EzXIWWCG/RMj:cF2jv47UQoe+RUWbIHCG/R4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b00000001233d-55.dat acprotect -
resource yara_rule behavioral1/files/0x000b00000001233d-55.dat upx behavioral1/memory/1220-56-0x0000000010000000-0x0000000010059000-memory.dmp upx behavioral1/memory/1220-57-0x0000000010000000-0x0000000010059000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1220 dbwmdjs_dtf.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 dbwmdjs_dtf.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe Token: 33 1220 dbwmdjs_dtf.exe Token: SeIncBasePriorityPrivilege 1220 dbwmdjs_dtf.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1220 dbwmdjs_dtf.exe 1220 dbwmdjs_dtf.exe 1220 dbwmdjs_dtf.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD50420f862d69bb050bb25fabebfbb8edb
SHA1897d1843f247a4820bff176f151d5a08203afcb1
SHA256d1632d3224740e37d4c243b6be8ecf5d5a7ccb41dff3f1f9886e36cbd2104a13
SHA512b0f86ee3cf82e32e138a8e1da79a0596da6f179bbb9c3e6673d57766860085d776ee2c34d4107cbac0bd569f9f5d30ba24c8f19d4b146ea8b8b889e782a3631d