Analysis

  • max time kernel
    92s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 20:33

General

  • Target

    8a77838fb50ac34647cc50214be992b7.exe

  • Size

    108KB

  • MD5

    8a77838fb50ac34647cc50214be992b7

  • SHA1

    ae15bdc7baa7b24ebc0e60743b22551418ea3634

  • SHA256

    02dd8f94860f4d3fee685d54f6b421ae4e8c28b737cb7d089951703dc21a33d1

  • SHA512

    ca586fc2c4ae8dfb9f54230fcb0fdd93b14b2949f081b23ba031128cfc8c58107956e34edd842ae2f6b6ed456803ef97fe40ca13b703e361c6ce1a986851120e

  • SSDEEP

    3072:OQqz1OWH1/D1O9t0Ohrx/dbamUakjHiJaQZ8Y:ORBBGmOJx/Ed5jHiJb8Y

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a77838fb50ac34647cc50214be992b7.exe
    "C:\Users\Admin\AppData\Local\Temp\8a77838fb50ac34647cc50214be992b7.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:1388

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\aspnet_counter.dll

          Filesize

          86KB

          MD5

          26bab8b8883f48d28b3d40733c83e3ea

          SHA1

          8ad36033dab14696119ef33bf65f179711811092

          SHA256

          dd9c693097dd387f7eaf69f95700361d59f65b8bf7a2c91eff22f35dd33c1868

          SHA512

          b04b6466a0d30b34d695425fce4f5fb8625eb1fd937bd197ff9d920ae79ea7146559c62aaeea572c4dd630cd7ce60d21984fd4a4cb9c53598635e1b6e655b721

        • memory/1388-0-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1388-1-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1388-7-0x00000000001C0000-0x00000000001FC000-memory.dmp

          Filesize

          240KB

        • memory/1388-10-0x0000000000400000-0x0000000000423000-memory.dmp

          Filesize

          140KB

        • memory/1388-11-0x00000000001C0000-0x00000000001FC000-memory.dmp

          Filesize

          240KB