Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
30/09/2023, 22:23
General
-
Target
8ee6cf7fa4d1d8f8e523070c57cbe946887bb44106ab1dd6a0da6c5e482641c1.exe
-
Size
2.1MB
-
MD5
76ceda3f93e3ae12198c418b02ee2d5f
-
SHA1
05e35d6315d6712df6c4da365dd3254b9450d69c
-
SHA256
8ee6cf7fa4d1d8f8e523070c57cbe946887bb44106ab1dd6a0da6c5e482641c1
-
SHA512
1773bd56559d457f473d1f09f819622c069f4ff06670f286584a60584ec43f43f6f191a720b5794250289a5cf3757fbe47c0a2e01dc310a3687f7d5220bed813
-
SSDEEP
49152:7pBY2t9j/5dbUA2Tp8+MEh1kAjIY/OdfSeW79/odXQYGPfQNkcZ8+Y3Ttm:7v1th5dbUAyp8+Lf/J/6eJFYGPYNTZ8p
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee6cf7fa4d1d8f8e523070c57cbe946887bb44106ab1dd6a0da6c5e482641c1.exe"C:\Users\Admin\AppData\Local\Temp\8ee6cf7fa4d1d8f8e523070c57cbe946887bb44106ab1dd6a0da6c5e482641c1.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39B
MD596c3f471248f2206a4d27fe81b40b142
SHA111130da4b0669d0fb0cf389e43fa1d1b5f6d5b08
SHA25670f0ab62a18c2a91cabe2fdf75aa5cd5b0230063633ba4c28098709b73634523
SHA512324c058c36b31a6b69d8dfde454f77f491910d3b8cf4e571c76915fe5b87b8f8d78572d1f4dad10d82297192f892ba5ec0e7d2cc12919b702dbaf52d826165cd
-
Filesize
1.3MB
MD5f41d8799b5c3f4a566c1c1d123d19104
SHA1378012570dda34cf682512763d7fe345842a4ad8
SHA2564cdf2f2135f641fad1d832a2dbb992e1b8e77521ef428b79527aae4ca7d6fa3f
SHA51214f387d9166a503bfb3d07bd8c10049f21ead9cf6edbd46f059bd486c9ef35e21dbcc1a6af871e5a0820a22e3012577eb4372ce939b258e266e3914047ff085f
-
Filesize
1.3MB
MD5f41d8799b5c3f4a566c1c1d123d19104
SHA1378012570dda34cf682512763d7fe345842a4ad8
SHA2564cdf2f2135f641fad1d832a2dbb992e1b8e77521ef428b79527aae4ca7d6fa3f
SHA51214f387d9166a503bfb3d07bd8c10049f21ead9cf6edbd46f059bd486c9ef35e21dbcc1a6af871e5a0820a22e3012577eb4372ce939b258e266e3914047ff085f
-
Filesize
1.3MB
MD5f41d8799b5c3f4a566c1c1d123d19104
SHA1378012570dda34cf682512763d7fe345842a4ad8
SHA2564cdf2f2135f641fad1d832a2dbb992e1b8e77521ef428b79527aae4ca7d6fa3f
SHA51214f387d9166a503bfb3d07bd8c10049f21ead9cf6edbd46f059bd486c9ef35e21dbcc1a6af871e5a0820a22e3012577eb4372ce939b258e266e3914047ff085f
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
3.4MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
3.4MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
32KB
-
Filesize
3.4MB
-
Filesize
4.6MB
-
Filesize
3.4MB
-
Filesize
4.6MB
-
Filesize
32KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB