Overview

overview

7

Static

static

3

338f347e64...df.exe

windows7-x64

7

338f347e64...df.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    1s
  • max time network
    7s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 18:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    338f347e6463a169e188cace09d527df.exe

  • Size

    1.0MB

  • MD5

    338f347e6463a169e188cace09d527df

  • SHA1

    0aa9a7503658976f85fa934c130a9d413f741993

  • SHA256

    10ae207c4fd654e74826f3c6d661d9259bf71bd43d76c0d9f5dc883826e2d3ed

  • SHA512

    13daa024d453442ef33f6d3e4c8e51423c0302243b377ad687062cb3d96c8e1f962625c232ba8541b02ec161c20f78b130cbb9c656e34b81a3fe849561721895

  • SSDEEP

    24576:3om/kwmJBXPhMJMQj4fF+SZsI+1g3IodNebI2Iyh:EwmJBfhM7mF+SZEKdEbIm

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\338f347e6463a169e188cace09d527df.exe
    "C:\Users\Admin\AppData\Local\Temp\338f347e6463a169e188cace09d527df.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hkl6A47.tmp
    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst6BE1.tmp\FindProcDLL.dll
    Filesize

    3KB

    MD5

    8614c450637267afacad1645e23ba24a

    SHA1

    e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

    SHA256

    0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

    SHA512

    af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst6BE1.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • memory/2424-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

    Download

  • memory/2424-4-0x00000000002E0000-0x0000000000353000-memory.dmp

    Filesize

    460KB

    Download