Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
20/09/2023, 00:21
General
-
Target
dfc474d4eac834fcad9cb1d88a7273aec181070cf551f15cc6c5cded4324d175.exe
-
Size
10.7MB
-
MD5
ab49ad81412be98c774cde275196c9cb
-
SHA1
d91e859e3b6a809881ac306425b1a46dc1628821
-
SHA256
dfc474d4eac834fcad9cb1d88a7273aec181070cf551f15cc6c5cded4324d175
-
SHA512
e32e89318e80896dca00f4f2f2c19efce37fc8de1d5fc965dd38ca94e21ec778c98f5df58caab1288aa748a6973a001ea0a4e480d56f1ba915b2dccc901ed0de
-
SSDEEP
196608:1kzGKRvAur/k6WD/voTpgPvgdWQmQPUwR5waKW1J0wI5h6PPIi:1kzG8v9MxD/vGkvgpUqN/xHz
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc474d4eac834fcad9cb1d88a7273aec181070cf551f15cc6c5cded4324d175.exe"C:\Users\Admin\AppData\Local\Temp\dfc474d4eac834fcad9cb1d88a7273aec181070cf551f15cc6c5cded4324d175.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5be702be6be99ad2203d50516014e5cd9
SHA1b4842827e5bc9de24e74d5b08afa0675df570dba
SHA25602bb80610621625b0c420a9fc8ba32efeef4b859b327aaa0dfb62da38abbf41c
SHA51279cfb96a73ec2b8341c59580f7ecd5db53b5023e41acad47e6e8bd8350532d1c4dcb04c1e62bbf3bd149b1779ed904b271bb1b9fb23c6fed1752ade43239f9a8
-
Filesize
80KB
MD5b220f0b3057a925147f57c5ebff51523
SHA1bb9faca3b0e9f849301ecbd58381e7965a143781
SHA256f12af891c0c1cb5e793ab260ff92e9792c8f7f2541162390a44c27e2e954dcb8
SHA5121e9fb6bd6005aab4f553b0a02c373671ce26fa773b06461e0041cfad0ae62bbf319105296ebd5e2c1ccf1c478ce17510aeb32dab8b83254fa2a18c9148f121f1
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
30.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
30.1MB
-
Filesize
30.1MB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
228KB
-
Filesize
64KB
-
Filesize
228KB
-
Filesize
228KB