ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4

General

Target

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Size

848KB
MD5

e631a4b49ba4d7f7b7c8564578fd7673
SHA1

db577da3897d30dcdf433a4c259482e6eb3cbc87
SHA256

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4
SHA512

3042f1413f30546efadb414c3df9f009c2fa6124ac6d69094871ac5ff532645e0e30ba6321fdc336b6cb281439c7eb3d46fd2ec6ef30f09cf1ee0e129c52f4c1
SSDEEP

12288:apRj81QWO+7y3Adkjp5p/WHBAn3/LyTX+U3t3rHGnTyTqqUXy00iWLaVOZ7Zr6nf:08kjImn3G9rcy9UXXnWLaW7ZGneOca3

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

pid	process
860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSecurityPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeTakeOwnershipPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeLoadDriverPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSystemProfilePrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSystemtimePrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeProfSingleProcessPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeIncBasePriorityPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeCreatePagefilePrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeBackupPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeRestorePrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeShutdownPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeDebugPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSystemEnvironmentPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeChangeNotifyPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeRemoteShutdownPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeUndockPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeManageVolumePrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeImpersonatePrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeCreateGlobalPrivilege	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 33	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 34	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 35	860	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

C:\Users\Admin\AppData\Local\Temp\ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
"C:\Users\Admin\AppData\Local\Temp\ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe"
1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-54-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/860-55-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/860-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/860-57-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/860-58-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/860-59-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/860-60-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/860-61-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads