76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5

General

Target

76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Size

346KB
MD5

38b3076aee17a06e90326c1fc614bc4b
SHA1

15dd17ddcd8c9054529a84642ef34f6cc4cbdb3c
SHA256

76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5
SHA512

292292423dee43c67ebb4c4c70bd2877ae4d4b4e9115dc137af0bb7f8c0046daa195338350efd4becff6d04db4a5868639e8b27733c952edd2f1e99a078880fd
SSDEEP

6144:AmXaP5GKP5XVpcmozyAqCoKYmPNwZW+R8OWQ6E33vdzDFfIx5RoGhIhp1jhasm:AVciXVpcNvq+YmP6ZhgQ6Myx5ja8

Score

9^/10

collection persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aqd.tmp	acprotect

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5016-132-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/5016-135-0x0000000010410000-0x000000001048A000-memory.dmp	upx
behavioral2/memory/2724-138-0x0000000010410000-0x000000001048A000-memory.dmp	upx
behavioral2/memory/2724-139-0x0000000010410000-0x000000001048A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Microsoft\Windows\mslhfin.exe	upx
behavioral2/memory/5016-141-0x0000000000400000-0x0000000000422000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aqd.tmp	upx
behavioral2/memory/2724-143-0x0000000010000000-0x000000001005A000-memory.dmp	upx
behavioral2/memory/2724-144-0x0000000010410000-0x000000001048A000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

2724 svchost.exe

pid	process
2724	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHN = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\mslhfin.exe"	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svchost.exe

pid process

2724 svchost.exe

pid	process
2724	svchost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeSecurityPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeTakeOwnershipPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeLoadDriverPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeSystemProfilePrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeSystemtimePrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeProfSingleProcessPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeIncBasePriorityPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeCreatePagefilePrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeBackupPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeRestorePrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeShutdownPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeDebugPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeSystemEnvironmentPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeRemoteShutdownPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeUndockPrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: SeManageVolumePrivilege	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: 33	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: 34	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: 35	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
Token: 36	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe

description	pid	process	target process
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe
PID 5016 wrote to memory of 2724	5016	76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe	svchost.exe

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe
"C:\Users\Admin\AppData\Local\Temp\76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- outlook_win_path
PID:2724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aqd.tmp
Filesize
171KB

MD5
1023df7abd2d9b7f0bdc77024c978f0b

SHA1
86f779a7bb2878bb0cc24cece2130bc451124a1d

SHA256
d7067d18aff17bbd5013a708f02e5d87beb20af19f2381986952a119ce5cf420

SHA512
1da1ca20319f9da92f1a1f0a2e590dcd1a87b8a2dd340b36ce680626ba68937a5f3c5f807afe29cb01e0000772044b892ed4cd1cf82337666fea7efc1955ecf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\mslhfin.exe
Filesize
346KB

MD5
38b3076aee17a06e90326c1fc614bc4b

SHA1
15dd17ddcd8c9054529a84642ef34f6cc4cbdb3c

SHA256
76c22064fefafa8f47b1e4f5acca095f33104b17bef65ce25a080b6eaa48abc5

SHA512
292292423dee43c67ebb4c4c70bd2877ae4d4b4e9115dc137af0bb7f8c0046daa195338350efd4becff6d04db4a5868639e8b27733c952edd2f1e99a078880fd

Download Submit
memory/2724-134-0x0000000000000000-mapping.dmp

Download
memory/2724-138-0x0000000010410000-0x000000001048A000-memory.dmp

Filesize
488KB

Download
memory/2724-139-0x0000000010410000-0x000000001048A000-memory.dmp

Filesize
488KB

Download
memory/2724-143-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2724-144-0x0000000010410000-0x000000001048A000-memory.dmp

Filesize
488KB

Download
memory/5016-132-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5016-135-0x0000000010410000-0x000000001048A000-memory.dmp

Filesize
488KB

Download
memory/5016-141-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads