Analysis
-
max time kernel
141s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
05/10/2023, 22:51
General
-
Target
bd9a19ba579a9b4cd49be45ec23f102f2fa925e1f55fa03e161a244c9a7d42c2.exe
-
Size
7.7MB
-
MD5
c0cc69db2db4bb54b9a61f7187adcc6c
-
SHA1
b41280b638b062311d1dd1dd9a702031ff6f228c
-
SHA256
bd9a19ba579a9b4cd49be45ec23f102f2fa925e1f55fa03e161a244c9a7d42c2
-
SHA512
1f71bafa3791d1202edd92bbdee3fe11bc25df55fa0ad6abf6a0cad954c03583d68d62450bd012e896f8c4b42e7db28b0100673f3e1a6f2a8ca4f5a94241cb1e
-
SSDEEP
98304:XyR58r6s2MmrYfIcvxHTK0pFA49iHKTX8xFsWMZzifvHX9eYzbHWk4qWaFhJhSGF:XRr6s3FxH+0pFAHqokv69hs+IIczZ8cu
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 3 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd9a19ba579a9b4cd49be45ec23f102f2fa925e1f55fa03e161a244c9a7d42c2.exe"C:\Users\Admin\AppData\Local\Temp\bd9a19ba579a9b4cd49be45ec23f102f2fa925e1f55fa03e161a244c9a7d42c2.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
MD59fc92bbf7571c4bb87b66e2568020409
SHA16e4397a7b400300c290d02384aff0316abd05050
SHA256ff02150249c62b8435421dd4a1a35c7c536eab2aba6c55a3b5d3e0eb22121f80
SHA5125c255facff05b1c664125da3e40bc4d8f8f8089234cd8e96009f6d7fd75de8d9fb72b457fe03600f55b1ce4a7c5063a9f20ace76bda151f52fa2dc7951fc33ea
-
Filesize
52KB
MD5fdc8b75a37017141831e3421479307be
SHA1f6a08cc570d5e5bc4218da376ca353d46d62790d
SHA2562a37ce301490bd4b7c5d02b768b054705fe4620db6ef81061718c1fe89c9f27e
SHA512d74e2de28523317c928965affa464cef6ba5c4da9ab05d30a79a4d3bbb59284d68331b5735c705cf73e155cf3a42b01ef5cd7219c72c242eed6b711090066537
-
Filesize
3.7MB
MD59fc92bbf7571c4bb87b66e2568020409
SHA16e4397a7b400300c290d02384aff0316abd05050
SHA256ff02150249c62b8435421dd4a1a35c7c536eab2aba6c55a3b5d3e0eb22121f80
SHA5125c255facff05b1c664125da3e40bc4d8f8f8089234cd8e96009f6d7fd75de8d9fb72b457fe03600f55b1ce4a7c5063a9f20ace76bda151f52fa2dc7951fc33ea
-
Filesize
52KB
MD5fdc8b75a37017141831e3421479307be
SHA1f6a08cc570d5e5bc4218da376ca353d46d62790d
SHA2562a37ce301490bd4b7c5d02b768b054705fe4620db6ef81061718c1fe89c9f27e
SHA512d74e2de28523317c928965affa464cef6ba5c4da9ab05d30a79a4d3bbb59284d68331b5735c705cf73e155cf3a42b01ef5cd7219c72c242eed6b711090066537
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.9MB
-
Filesize
8.1MB
-
Filesize
9.0MB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
1.5MB
-
Filesize
60KB
-
Filesize
4.9MB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
8.1MB
-
Filesize
9.0MB
-
Filesize
8KB
-
Filesize
4.9MB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB