Analysis
-
max time kernel
157s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 02:04
Behavioral task
behavioral1
Sample
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
-
Size
2.1MB
-
MD5
15b5b4d7c7e333a84a4d7f3813b08e78
-
SHA1
0496cbcc74dd2c208d827e5fbeed705162841012
-
SHA256
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0
-
SHA512
879db7d6600cc5c55b5a7644344429540433e175fc2745018d3351f1bf5ca58ca65c7a1797b0d76d5c884dfe62c55ff04bfe74fad71a3a36f32e613bc100858d
-
SSDEEP
49152:wZ9mdNxmKmvfJe4dI/tbNWLcn979RATyxzPM8Y4+cxHVC:QXtc4dIVBWLc9ITuFH
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x001b0000000162eb-3.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe -
resource yara_rule behavioral1/memory/2096-0-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/files/0x001b0000000162eb-3.dat upx behavioral1/memory/2096-5-0x0000000010000000-0x0000000010046000-memory.dmp upx behavioral1/memory/2096-6-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-7-0x0000000010000000-0x0000000010046000-memory.dmp upx behavioral1/memory/2096-8-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-9-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-11-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-13-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-15-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-17-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-19-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-21-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-23-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-25-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-27-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-29-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-31-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral1/memory/2096-33-0x0000000000400000-0x0000000000C1A000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe 2096 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe"C:\Users\Admin\AppData\Local\Temp\87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5d7d0661ef693c8aceebcc52ffc620c9b
SHA19b6f144ab58736d7ae685985727572a008d28fbe
SHA256dbeceadf49a2e2a33af612d08938cd78951eea7038e09952c032bd70dd25a1f4
SHA512babed456f3b994ce915a310d29b303dfb870c6474a750fc04f695d71fa51394869c2e578d5d33e750c83ee161b77c1a1e459b5e9813b12e83bd7ab8f2b080c6a