Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/12/2023, 15:09
General
-
Target
282a696d2042e868ee9caa45160fc4db.exe
-
Size
3.2MB
-
MD5
282a696d2042e868ee9caa45160fc4db
-
SHA1
8aea4e6e0b54f4a3041ac758debcad7025a9836d
-
SHA256
10aaa554a02fd968293d7d5e9baf03379ccf0aa932e093d321edba128e988e50
-
SHA512
823bbdb5f088e989998b40bbb1c7f87bf5a586bfbcfd37b3a67a72d0c10de263c953a751db56b2be1a76382fdd78309256d5435e23d8c93b7f51490567c078fe
-
SSDEEP
98304:dnLPBRzNe3VnQEiXmvAAWEiWQoay2ZXWYJArIcUAur:95nENQE7v08BadZmlWr
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\282a696d2042e868ee9caa45160fc4db.exe"C:\Users\Admin\AppData\Local\Temp\282a696d2042e868ee9caa45160fc4db.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
602KB
MD5b8e3055256d77eec59d6dc3d864acf15
SHA181e8edaf99cd063ea1054896cc4a449fd8fae7eb
SHA2564b716d615aafc9095ec0daaa764a8c13c668b1f76ea566a407c906c2d2b6fc95
SHA512ec19426476c791a78c4529cf24abf2fb571529565567bf28957d1f3c0476c0ca0e502763a18f351b076bb9a12c7330aea92ef3fb8c2958a2e1021fca0f59f08a
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
4KB
-
Filesize
7.3MB
-
Filesize
2.4MB
-
Filesize
212KB
-
Filesize
4KB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
2.4MB
-
Filesize
2.4MB