Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/01/2024, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f32860279ea5b9675ab0065f84e3110.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f32860279ea5b9675ab0065f84e3110.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
3f32860279ea5b9675ab0065f84e3110.exe
-
Size
41KB
-
MD5
3f32860279ea5b9675ab0065f84e3110
-
SHA1
7e5f71cf927ac4ae37cdad41fa0899dca2744bcc
-
SHA256
47a1f209f27edfbc580d20803f638a6a6f764443cf7ee3fade5e3caba1e8a7a5
-
SHA512
69b13a65b556ff6bc7424f6203ff47873909eec3a8f54020336398fd27ffc7645bd4c69684b2e43164b4543f59f50c64ac843d0fd33ad425929fddb5dfefaee8
-
SSDEEP
384:qeoTzUN0mxwf/uPyfERURLt+iB8qa0ASU70FCTM7W7fyIcaviVUrBo:WHG0mxwHyyfEiRJr3tfS2IuVUG
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a0000000126e1-3.dat acprotect -
Deletes itself 1 IoCs
pid Process 2980 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2352 3f32860279ea5b9675ab0065f84e3110.exe -
resource yara_rule behavioral1/files/0x000a0000000126e1-3.dat upx behavioral1/memory/2352-5-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral1/memory/2352-6-0x0000000010000000-0x0000000010011000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mFr9FPruEFZ9VNdrveJunw3.dll 3f32860279ea5b9675ab0065f84e3110.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fOnts\tHCsj3zT7wpspzWKuBu.Ttf 3f32860279ea5b9675ab0065f84e3110.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9AD1DE62-196C-4C01-9A2F-0BEDEF727C59}\InprocServer32 3f32860279ea5b9675ab0065f84e3110.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9AD1DE62-196C-4C01-9A2F-0BEDEF727C59}\InprocServer32\ = "C:\\Windows\\SysWow64\\mFr9FPruEFZ9VNdrveJunw3.dll" 3f32860279ea5b9675ab0065f84e3110.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9AD1DE62-196C-4C01-9A2F-0BEDEF727C59}\InprocServer32\ThreadingModel = "Apartment" 3f32860279ea5b9675ab0065f84e3110.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{9AD1DE62-196C-4C01-9A2F-0BEDEF727C59}\InprocServer32 3f32860279ea5b9675ab0065f84e3110.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 3f32860279ea5b9675ab0065f84e3110.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 3f32860279ea5b9675ab0065f84e3110.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9AD1DE62-196C-4C01-9A2F-0BEDEF727C59} 3f32860279ea5b9675ab0065f84e3110.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2352 3f32860279ea5b9675ab0065f84e3110.exe 2352 3f32860279ea5b9675ab0065f84e3110.exe 2352 3f32860279ea5b9675ab0065f84e3110.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe Token: SeDebugPrivilege 2352 3f32860279ea5b9675ab0065f84e3110.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2352 3f32860279ea5b9675ab0065f84e3110.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2980 2352 3f32860279ea5b9675ab0065f84e3110.exe 28 PID 2352 wrote to memory of 2980 2352 3f32860279ea5b9675ab0065f84e3110.exe 28 PID 2352 wrote to memory of 2980 2352 3f32860279ea5b9675ab0065f84e3110.exe 28 PID 2352 wrote to memory of 2980 2352 3f32860279ea5b9675ab0065f84e3110.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f32860279ea5b9675ab0065f84e3110.exe"C:\Users\Admin\AppData\Local\Temp\3f32860279ea5b9675ab0065f84e3110.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3F3286~1.EXE >> NUL2⤵
- Deletes itself
PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5459bb06449fc85298eda930cfd2d1894
SHA1bf442ac24c1fe0e9c3d9424b4dd3dcc873c695ad
SHA256f2820348771937bdc1db00fbc4496c233570179db7ea876da7dd4132cf878ba7
SHA512d0cdeed942ec76f5b820504314a7f15d1375d30058a04b823fa970a8ac1664aea13aa596cc6d0218ec1f60982477d1db5c2b115928d9d7e0217110e7ccc68bed