ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4

General

Target

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Size

848KB
MD5

e631a4b49ba4d7f7b7c8564578fd7673
SHA1

db577da3897d30dcdf433a4c259482e6eb3cbc87
SHA256

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4
SHA512

3042f1413f30546efadb414c3df9f009c2fa6124ac6d69094871ac5ff532645e0e30ba6321fdc336b6cb281439c7eb3d46fd2ec6ef30f09cf1ee0e129c52f4c1
SSDEEP

12288:apRj81QWO+7y3Adkjp5p/WHBAn3/LyTX+U3t3rHGnTyTqqUXy00iWLaVOZ7Zr6nf:08kjImn3G9rcy9UXXnWLaW7ZGneOca3

Score

9^/10

evasion

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

pid	process
2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSecurityPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeTakeOwnershipPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeLoadDriverPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSystemProfilePrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSystemtimePrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeProfSingleProcessPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeIncBasePriorityPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeCreatePagefilePrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeBackupPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeRestorePrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeShutdownPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeDebugPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeSystemEnvironmentPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeChangeNotifyPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeRemoteShutdownPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeUndockPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeManageVolumePrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeImpersonatePrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: SeCreateGlobalPrivilege	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 33	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 34	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 35	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
Token: 36	2276	ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe

C:\Users\Admin\AppData\Local\Temp\ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe
"C:\Users\Admin\AppData\Local\Temp\ac17500d6e5e630ca82662a2408aa44e926e105bda990b11227db9f436042bb4.exe"
1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

Software Discovery

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-132-0x00000000022C0000-0x00000000022ED000-memory.dmp

Filesize
180KB

Download
memory/2276-133-0x00000000022C0000-0x00000000022ED000-memory.dmp

Filesize
180KB

Download
memory/2276-134-0x00000000022C0000-0x00000000022C5000-memory.dmp

Filesize
20KB

Download
memory/2276-135-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/2276-136-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/2276-137-0x00000000022C0000-0x00000000022C5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads