Analysis
-
max time kernel
84s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
22/08/2023, 21:44
General
-
Target
file_access_monitor_setup.exe
-
Size
4.1MB
-
MD5
40145e48b1df0d0a2c996e3608693205
-
SHA1
11a86ac7c2e8a0bc8194851027836671143ac1cb
-
SHA256
9a011991b5afef9feae6f13faa7e04e7a708aa010b47e405bd9266bfc1b0c8c2
-
SHA512
800fcbe4fd1c3d796a1fd9e63094d20093dbb536ead5d9b61e08085b28b6dee463e28dc83a0b30a1348743e2dafd0326637fd95bd8747ac86fd56c09f0c79bcb
-
SSDEEP
98304:gL0g15ysxQwbo+pvBxVI4haEsCEPwa+v1lqLxjN:gLT59xQMjjVDhDfa+v/qLxp
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops file in Program Files directory 11 IoCs
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file_access_monitor_setup.exe"C:\Users\Admin\AppData\Local\Temp\file_access_monitor_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0Q9DC.tmp\file_access_monitor_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-0Q9DC.tmp\file_access_monitor_setup.tmp" /SL5="$5022A,3929571,121344,C:\Users\Admin\AppData\Local\Temp\file_access_monitor_setup.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop FAMService3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FAMService4⤵
-
-
-
C:\Program Files\SoftPerfect File Access Monitor\install.exe"C:\Program Files\SoftPerfect File Access Monitor\install.exe" /silent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe"C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe" /sinstall3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe"C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe" /INSTALL /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="SoftPerfect File Access Monitor Service" dir=in action=allow program="C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe" enable=yes3⤵
- Modifies Windows Firewall
-
-
C:\Program Files\SoftPerfect File Access Monitor\FAMGUI.exe"C:\Program Files\SoftPerfect File Access Monitor\FAMGUI.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe"C:\Program Files\SoftPerfect File Access Monitor\FAMCore.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD5e87c1c2e4bf7f5c5f66b37ea6b02510d
SHA13b28328f009a8abcb497e6c0774150416dce4f12
SHA2563397538975a8122dff137c808d7305174c03e1a74d76f45873e709c84bd22e27
SHA5125c93b8b3498cb17edc6addbc93e8cfb115fadf4c21a60b928cdc508648ded588106bfe8ac0866c9edb938094ffa382c6ac70f1c8bdfd45b4dcaddcfdcb469841
-
Filesize
4.8MB
MD5e87c1c2e4bf7f5c5f66b37ea6b02510d
SHA13b28328f009a8abcb497e6c0774150416dce4f12
SHA2563397538975a8122dff137c808d7305174c03e1a74d76f45873e709c84bd22e27
SHA5125c93b8b3498cb17edc6addbc93e8cfb115fadf4c21a60b928cdc508648ded588106bfe8ac0866c9edb938094ffa382c6ac70f1c8bdfd45b4dcaddcfdcb469841
-
Filesize
4.8MB
MD5e87c1c2e4bf7f5c5f66b37ea6b02510d
SHA13b28328f009a8abcb497e6c0774150416dce4f12
SHA2563397538975a8122dff137c808d7305174c03e1a74d76f45873e709c84bd22e27
SHA5125c93b8b3498cb17edc6addbc93e8cfb115fadf4c21a60b928cdc508648ded588106bfe8ac0866c9edb938094ffa382c6ac70f1c8bdfd45b4dcaddcfdcb469841
-
Filesize
4.8MB
MD5e87c1c2e4bf7f5c5f66b37ea6b02510d
SHA13b28328f009a8abcb497e6c0774150416dce4f12
SHA2563397538975a8122dff137c808d7305174c03e1a74d76f45873e709c84bd22e27
SHA5125c93b8b3498cb17edc6addbc93e8cfb115fadf4c21a60b928cdc508648ded588106bfe8ac0866c9edb938094ffa382c6ac70f1c8bdfd45b4dcaddcfdcb469841
-
Filesize
5.6MB
MD5c45054bef4fa37fb354de30d738521b9
SHA1856ae79e8b1869464b577418936dcadaa2abcea7
SHA2564cd8f832ad2e0d0a3f232bcce52f258af253c44da42d6f98456a87082112bec6
SHA512593e257156c964a6cee4a6caa72987ffd5b9d3afb20f6f1e9bf38120fc8a566482a6dbbf4e3a2986d9f58427ee69ba3ffedd67e6eed4dcc98ea52da134221da8
-
Filesize
5.6MB
MD5c45054bef4fa37fb354de30d738521b9
SHA1856ae79e8b1869464b577418936dcadaa2abcea7
SHA2564cd8f832ad2e0d0a3f232bcce52f258af253c44da42d6f98456a87082112bec6
SHA512593e257156c964a6cee4a6caa72987ffd5b9d3afb20f6f1e9bf38120fc8a566482a6dbbf4e3a2986d9f58427ee69ba3ffedd67e6eed4dcc98ea52da134221da8
-
Filesize
5.6MB
MD5c45054bef4fa37fb354de30d738521b9
SHA1856ae79e8b1869464b577418936dcadaa2abcea7
SHA2564cd8f832ad2e0d0a3f232bcce52f258af253c44da42d6f98456a87082112bec6
SHA512593e257156c964a6cee4a6caa72987ffd5b9d3afb20f6f1e9bf38120fc8a566482a6dbbf4e3a2986d9f58427ee69ba3ffedd67e6eed4dcc98ea52da134221da8
-
Filesize
123KB
MD5b3386a08a86fa105f1dde4495112172b
SHA129ad2b9c6c0f50042101436af965c5ee4701acd5
SHA256232c83809e8858491ee6bc941f30ab9092bb1c484c1de5e9a92a88862a0ab934
SHA512a140f4134865af204f6b174ff9e4aa946f3ee3b51850db550824b0b8cddbf6ce12e353850152ebd8b222b4717ae4bed3f57f74cf01784dd7e202644e2fceff2a
-
Filesize
99KB
MD58098e9ab9900eef4b0c78cc057f5eb6f
SHA1d8246dcc071e43b34e2281b495d076e3b30d151c
SHA256adbde5be08465d127b167bb68da6596a90d845d96ad1381812e8b838e0f958bc
SHA512d3667c3dd9ad2d00389370acffd58a1418407fa3beb889322249cb4ec68a7fd78fe9d10d087e4ed6f16fb3c128c7238fef0bee6e4786a888848bd89abca817f3
-
Filesize
99KB
MD58098e9ab9900eef4b0c78cc057f5eb6f
SHA1d8246dcc071e43b34e2281b495d076e3b30d151c
SHA256adbde5be08465d127b167bb68da6596a90d845d96ad1381812e8b838e0f958bc
SHA512d3667c3dd9ad2d00389370acffd58a1418407fa3beb889322249cb4ec68a7fd78fe9d10d087e4ed6f16fb3c128c7238fef0bee6e4786a888848bd89abca817f3
-
Filesize
794KB
MD55bc229a3c39be924e413ba01cc77fb17
SHA17f3d0b52527e79c3325c531e78ca6ed249a5eca8
SHA256b1b0a0b879e4385a4d6d442f13255063c4b52d5f45e4f105a6dcbcf70a25b7be
SHA512d448d96bd4b2e448debace4da6b71e1e3062b3f34f7f77448a936660ac892d096ea64dcb5102743f2fdef208008816b040649831fe4fe201a6f154d7d276a01e
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
123KB
MD5b3386a08a86fa105f1dde4495112172b
SHA129ad2b9c6c0f50042101436af965c5ee4701acd5
SHA256232c83809e8858491ee6bc941f30ab9092bb1c484c1de5e9a92a88862a0ab934
SHA512a140f4134865af204f6b174ff9e4aa946f3ee3b51850db550824b0b8cddbf6ce12e353850152ebd8b222b4717ae4bed3f57f74cf01784dd7e202644e2fceff2a
-
Filesize
123KB
MD5b3386a08a86fa105f1dde4495112172b
SHA129ad2b9c6c0f50042101436af965c5ee4701acd5
SHA256232c83809e8858491ee6bc941f30ab9092bb1c484c1de5e9a92a88862a0ab934
SHA512a140f4134865af204f6b174ff9e4aa946f3ee3b51850db550824b0b8cddbf6ce12e353850152ebd8b222b4717ae4bed3f57f74cf01784dd7e202644e2fceff2a
-
Filesize
123KB
MD5b3386a08a86fa105f1dde4495112172b
SHA129ad2b9c6c0f50042101436af965c5ee4701acd5
SHA256232c83809e8858491ee6bc941f30ab9092bb1c484c1de5e9a92a88862a0ab934
SHA512a140f4134865af204f6b174ff9e4aa946f3ee3b51850db550824b0b8cddbf6ce12e353850152ebd8b222b4717ae4bed3f57f74cf01784dd7e202644e2fceff2a
-
Filesize
123KB
MD5b3386a08a86fa105f1dde4495112172b
SHA129ad2b9c6c0f50042101436af965c5ee4701acd5
SHA256232c83809e8858491ee6bc941f30ab9092bb1c484c1de5e9a92a88862a0ab934
SHA512a140f4134865af204f6b174ff9e4aa946f3ee3b51850db550824b0b8cddbf6ce12e353850152ebd8b222b4717ae4bed3f57f74cf01784dd7e202644e2fceff2a
-
Filesize
794KB
MD55bc229a3c39be924e413ba01cc77fb17
SHA17f3d0b52527e79c3325c531e78ca6ed249a5eca8
SHA256b1b0a0b879e4385a4d6d442f13255063c4b52d5f45e4f105a6dcbcf70a25b7be
SHA512d448d96bd4b2e448debace4da6b71e1e3062b3f34f7f77448a936660ac892d096ea64dcb5102743f2fdef208008816b040649831fe4fe201a6f154d7d276a01e
-
Filesize
794KB
MD55bc229a3c39be924e413ba01cc77fb17
SHA17f3d0b52527e79c3325c531e78ca6ed249a5eca8
SHA256b1b0a0b879e4385a4d6d442f13255063c4b52d5f45e4f105a6dcbcf70a25b7be
SHA512d448d96bd4b2e448debace4da6b71e1e3062b3f34f7f77448a936660ac892d096ea64dcb5102743f2fdef208008816b040649831fe4fe201a6f154d7d276a01e
-
Filesize
794KB
MD55bc229a3c39be924e413ba01cc77fb17
SHA17f3d0b52527e79c3325c531e78ca6ed249a5eca8
SHA256b1b0a0b879e4385a4d6d442f13255063c4b52d5f45e4f105a6dcbcf70a25b7be
SHA512d448d96bd4b2e448debace4da6b71e1e3062b3f34f7f77448a936660ac892d096ea64dcb5102743f2fdef208008816b040649831fe4fe201a6f154d7d276a01e
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4KB