Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 06:48
General
-
Target
2c3285ff73241b51c95e7a003d5fd223.exe
-
Size
711KB
-
MD5
2c3285ff73241b51c95e7a003d5fd223
-
SHA1
7174bcf713b66b13dc6f574bd71c9cb60e15fcc8
-
SHA256
132cb6059a9d22905405b754535d72a8bd03d1d1c5cd1419034919f7ecbf2d5e
-
SHA512
44bc7b93f65ac652e7537dc0229320e19da8fcc840d83142573efb35b4deee2c3b85d3d978496aba7e96796d3ef1323bad9129ec9be95b57b4d747c43b44c536
-
SSDEEP
12288:07mlXFD+sU5hGegIGZ7nW7EiRoCrYhYDUlYeWS6KOjr45oRMoBaOmYckAXMIOtor:07mlXFD+PPGZQloCrYmDNej6J8ZolW8G
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 10 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 24 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c3285ff73241b51c95e7a003d5fd223.exe"C:\Users\Admin\AppData\Local\Temp\2c3285ff73241b51c95e7a003d5fd223.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winrsz.exeC:\Windows\system32\winrsz.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5d48a2f492576ee9a2490729f9ff9c2f7
SHA1165b2e1ce2ef9d8f077f53d5c7a846399103fa75
SHA256176466611c43ff942d8d66baa928d8c15bd40816fe2d9f62dd66ce558e7e5e75
SHA512f37d6eb6155694ded6df79dce57aa77fe6b71875fd63608952f3dbf33a791137c171ff54331cc01d200250340da01f47dac384e2f5f814c43052d89c873c034f
-
Filesize
124KB
MD592044aa003c045ce5ba6f3095515218e
SHA18c261feba60d1b3a69d583b17d12f21029b9daa0
SHA256570f270a2528011596be10fa9d0ee96d9b1255c82e61c0a3b9ed3a71474ea896
SHA5124156f2ebf8c770368265f3a30051b0825fd9494a6d8c848a87210f82f022a8dbc51c6b648b65414212e4a19effc5d054a6c7de859ff1b97f3a49362f441c8085
-
Filesize
69KB
MD52ad44db3f0317eb9c2155fa79c3c5d61
SHA100937065002d0ceb35484f6794721be00c7cd7c2
SHA25614e45a995ea7985f2971ce280a7eeed728d0d839abf07505f765027097644361
SHA512a1e2312db3533f2002353f9a28e8a5a68745dd0cd61125b232f0bae0f2da09deda85b5e5bab8410d81ee5aac0cd9da2ee6e6b9c37699b9ac7970174abd4d4b63
-
Filesize
92KB
MD56e9d501d45f453dbda7b31785c02ea28
SHA1dfaaa0692306a735bbff9bb8de61b5f1bf00e567
SHA2567f757451591a8457cf74e0f523e3304e670328a81ca12135bb48b998edbdb1e1
SHA51242256d5dc30e2ef478a93205f820e452df0750910717a26d27fcd7989d96128888f0542bb791200991f7fb22d095997382c2fcdd1fb1f4ab573c42006fdcd611
-
Filesize
377KB
MD5037f9dcf60cdbd7557d1a9899c21dc00
SHA1b3b2aab8cca56095aed536f715d4669e59d787c4
SHA25660730fe84396d5be519be1755d934512d470430cf3248d7267f81da536ccd88c
SHA512e07ea584ea93e736567394c8941acdb43d813c74d1bd0ea903c966df77cddd57ad21cc4ec99a6eadcd5b0831f7acf213b5ee4251c7d767b1ba0fe3f31ac17e4f
-
Filesize
711KB
MD52c3285ff73241b51c95e7a003d5fd223
SHA17174bcf713b66b13dc6f574bd71c9cb60e15fcc8
SHA256132cb6059a9d22905405b754535d72a8bd03d1d1c5cd1419034919f7ecbf2d5e
SHA51244bc7b93f65ac652e7537dc0229320e19da8fcc840d83142573efb35b4deee2c3b85d3d978496aba7e96796d3ef1323bad9129ec9be95b57b4d747c43b44c536
-
Filesize
104KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
132KB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
176KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
132KB
-
Filesize
1.1MB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
104KB