Analysis
-
max time kernel
30s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05/12/2022, 20:15
General
-
Target
b8831b4e947c9a8b36f2a8cb31da9c7f5a5a5325bc608285f442293fc6024cc2.exe
-
Size
34KB
-
MD5
6ad7192169125cc8eb6e76e629fabf7a
-
SHA1
138680488617ddc1c42c06f98aab399eda93a352
-
SHA256
b8831b4e947c9a8b36f2a8cb31da9c7f5a5a5325bc608285f442293fc6024cc2
-
SHA512
2533f12629156581e553889f99d76ddce40bada8ee2a0ae4701ba179b59e00b83f17c8996f8c297ed4377e515458a073204892e636463bd144cb3602b55f4df4
-
SSDEEP
768:REjoldIsxKGrhdnIECnbcuyD7UF2rTQEf06e4FSMKv2ICAiOLk:REIdPxBrIECnouy8FiQ+JecW2ICAiO4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Modifies registry class 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8831b4e947c9a8b36f2a8cb31da9c7f5a5a5325bc608285f442293fc6024cc2.exe"C:\Users\Admin\AppData\Local\Temp\b8831b4e947c9a8b36f2a8cb31da9c7f5a5a5325bc608285f442293fc6024cc2.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /n /s /i:"-f 7b8a2d95-0ac9-11d1-896c-00c04Fb6bfc4 -f D1FE6762-FC48-11D0-883A-3C8B00C10000" "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DA0O538997.dll"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5190da29d5f5683f33c4e8847f27045b7
SHA1ca7478e5f729f2854edc92255e6dda285e7a35d7
SHA2563b228e6a5cf10bbe1f2b98af59c97862c031efcf7eb4cf760ab0b88f5fdadb84
SHA512a9583ba9a432b3bdb23e52bdc24a6bfdbc87207b278b13dafbb68852f2557202e3389ee2b55e2e1a5eda4b039ec1d5a24da5755f4f2932036db1d3334ffe45e3
-
Filesize
15KB
MD5190da29d5f5683f33c4e8847f27045b7
SHA1ca7478e5f729f2854edc92255e6dda285e7a35d7
SHA2563b228e6a5cf10bbe1f2b98af59c97862c031efcf7eb4cf760ab0b88f5fdadb84
SHA512a9583ba9a432b3bdb23e52bdc24a6bfdbc87207b278b13dafbb68852f2557202e3389ee2b55e2e1a5eda4b039ec1d5a24da5755f4f2932036db1d3334ffe45e3
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
104KB
-
Filesize
104KB