Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24/12/2023, 22:29
General
-
Target
15c9cc39556963bcb45eaed731b535e2.exe
-
Size
453KB
-
MD5
15c9cc39556963bcb45eaed731b535e2
-
SHA1
9c75b46cbfec64d764bf631d63df42825f72535f
-
SHA256
2147fdbdde3c717392c2c2edfbeb759d2c5fc969b7a3df1236dfe0e0b6b85ea9
-
SHA512
db304b312ca3016fe150baecbcd1c0e03659dbb95418744b486304b95dd4e2a4d6b5f29048b939bd68347c93dd564dfc2125a335c30f7ffc10d3ce48ebe87f0a
-
SSDEEP
12288:Fk9ax11s15Ap/G/8g3D0Fw/tN8dkmLtpHHHrh7P:FR16j8gz0FmcLbH1P
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 54 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c9cc39556963bcb45eaed731b535e2.exe"C:\Users\Admin\AppData\Local\Temp\15c9cc39556963bcb45eaed731b535e2.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -NoProfile -NoLogo -Command "Write-Host ($PSVersionTable.psversion)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS^|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)^|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)^|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)^|$($_.productState)\"};} Write-Host ($avlist -join \"^*\")}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
114KB
MD5a3ed6f7ea493b9644125d494fbf9a1e6
SHA1ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA256ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
SHA5127099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
-
Filesize
129KB
MD5625cbd633c3bdb18642f673698dde61b
SHA17877e7a70801ca277fb48b245577adba6cd1a39a
SHA256dc9198fdf71113735f367bc566f46c59ee316fa052837a1bdbce8dbf91fad106
SHA5121f3dc646b749fac36bd87c026d9c17f01761d54b36daf9f858d35f030d3586ec4913d0c73e1098479c5d3ee7fb9d539a133e76efc050b595d6e296697343f052
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
-
Filesize
93KB
MD5cd390387039d7d2928e297b3d23edbc8
SHA19d6fb8ca71214be21a0a57ed5abdffde71870549
SHA2566a91606c5b6de503e35d30112368ed5fdf30eaeabe0f0ecef8b50b08c4ca1870
SHA512f96711484dd1730c6b1108ec0356aeb3b8f0a3aabe8b13c09ce8c1454dc7b0d64859ac0b8eadedecf8a1a21d43e29576c779625b6571202f7469bf74e1c86483
-
Filesize
20KB
MD5e541458cfe66ef95ffbea40eaaa07289
SHA1caec1233f841ee72004231a3027b13cdeb13274c
SHA2563bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
SHA5120bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
7KB
MD5b9cd1b0fd3af89892348e5cc3108dce7
SHA1f7bc59bf631303facfc970c0da67a73568e1dca6
SHA25649b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
SHA512fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
6.5MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
152KB
-
Filesize
40KB