15f14ac1a2f53b0b59f59b813caabb069beeefada78ea43d58d7c768355c4952

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0676ba9ee712af9eef679f64e5bf470f.exe
Size

353KB
MD5

0676ba9ee712af9eef679f64e5bf470f
SHA1

6f210ebac932c4165c3110ca860709984ae50b37
SHA256

15f14ac1a2f53b0b59f59b813caabb069beeefada78ea43d58d7c768355c4952
SHA512

3dfc60caac2a3580f0cd72105c2abc87bef1ee4c25f3649351b5e83e946ea14a402fccdb2d34ddc3cd07bd0c9c2c4d903fa18b0a04ebe33477c4ad3b36317420
SSDEEP

6144:xWVhOlf2/ZBaWeRIiMWT8bn6pe+kdXGSuKMCjz3TQThVE1DwCzptVmjNioC16Vau:xW2l+/ZsHCZ0inUe+kdoK/TTQIaC8jNj

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a000000012232-2.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3032	0676ba9ee712af9eef679f64e5bf470f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	0676ba9ee712af9eef679f64e5bf470f.exe

C:\Users\Admin\AppData\Local\Temp\0676ba9ee712af9eef679f64e5bf470f.exe
"C:\Users\Admin\AppData\Local\Temp\0676ba9ee712af9eef679f64e5bf470f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\aqlA100.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/3032-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-4-0x0000000000470000-0x00000000004E3000-memory.dmp

Filesize
460KB

Download
memory/3032-5-0x0000000000470000-0x00000000004E3000-memory.dmp

Filesize
460KB

Download
memory/3032-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download