Analysis
-
max time kernel
159s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 02:04
Behavioral task
behavioral1
Sample
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
-
Size
2.1MB
-
MD5
15b5b4d7c7e333a84a4d7f3813b08e78
-
SHA1
0496cbcc74dd2c208d827e5fbeed705162841012
-
SHA256
87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0
-
SHA512
879db7d6600cc5c55b5a7644344429540433e175fc2745018d3351f1bf5ca58ca65c7a1797b0d76d5c884dfe62c55ff04bfe74fad71a3a36f32e613bc100858d
-
SSDEEP
49152:wZ9mdNxmKmvfJe4dI/tbNWLcn979RATyxzPM8Y4+cxHVC:QXtc4dIVBWLc9ITuFH
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000900000002320a-3.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe -
resource yara_rule behavioral2/memory/2632-0-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/files/0x000900000002320a-3.dat upx behavioral2/memory/2632-6-0x0000000010000000-0x0000000010046000-memory.dmp upx behavioral2/memory/2632-7-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-8-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-9-0x0000000010000000-0x0000000010046000-memory.dmp upx behavioral2/memory/2632-10-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-12-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-14-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-16-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-18-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-20-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-22-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-24-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-26-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-28-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-30-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-32-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-34-0x0000000000400000-0x0000000000C1A000-memory.dmp upx behavioral2/memory/2632-36-0x0000000000400000-0x0000000000C1A000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: 33 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe Token: SeIncBasePriorityPrivilege 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe 2632 87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe"C:\Users\Admin\AppData\Local\Temp\87da0d6c8302715d2ff3282e77ed9215b2611a8ea101d27e1ff5742cd10e14a0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2632
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5d7d0661ef693c8aceebcc52ffc620c9b
SHA19b6f144ab58736d7ae685985727572a008d28fbe
SHA256dbeceadf49a2e2a33af612d08938cd78951eea7038e09952c032bd70dd25a1f4
SHA512babed456f3b994ce915a310d29b303dfb870c6474a750fc04f695d71fa51394869c2e578d5d33e750c83ee161b77c1a1e459b5e9813b12e83bd7ab8f2b080c6a