Analysis

  • max time kernel
    120s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-02-2024 12:36

General

  • Target

    AkebiLauncherInjectionFix.exe

  • Size

    88.8MB

  • MD5

    3e09e825e128b58ae0615b8d2e7125b5

  • SHA1

    19eda6aa5b2604af985305d99590666a77f7ce1c

  • SHA256

    326ef5ecf9c30558aecc826e23e32ff1bb5876399906b0108b1c2701ae961c6d

  • SHA512

    31927eafaf4b9ce4fbd994eecc7f625eae606499bd162f42189f004f9db0e65f26ab7dfd2fb423f5031eca8a8a456d488fa117ff3012224228feb8f29e941a82

  • SSDEEP

    1572864:MZ9ENal21u4x/MQNKdtdbBcRjsR1nmAUIQozSxlb7E6SjtsIw5yjhsEeAuMtVaUG:MDENal21TxklBJ1nmA9AbQ6Sj2IWWeAR

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AkebiLauncherInjectionFix.exe
    "C:\Users\Admin\AppData\Local\Temp\AkebiLauncherInjectionFix.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1540-0-0x0000000077520000-0x0000000077522000-memory.dmp

    Filesize

    8KB

  • memory/1540-2-0x0000000077520000-0x0000000077522000-memory.dmp

    Filesize

    8KB

  • memory/1540-4-0x0000000077520000-0x0000000077522000-memory.dmp

    Filesize

    8KB

  • memory/1540-7-0x0000000077540000-0x0000000077542000-memory.dmp

    Filesize

    8KB

  • memory/1540-5-0x0000000077540000-0x0000000077542000-memory.dmp

    Filesize

    8KB

  • memory/1540-9-0x0000000077540000-0x0000000077542000-memory.dmp

    Filesize

    8KB

  • memory/1540-10-0x0000000077550000-0x0000000077552000-memory.dmp

    Filesize

    8KB

  • memory/1540-12-0x0000000077550000-0x0000000077552000-memory.dmp

    Filesize

    8KB

  • memory/1540-14-0x0000000077550000-0x0000000077552000-memory.dmp

    Filesize

    8KB

  • memory/1540-15-0x0000000077560000-0x0000000077562000-memory.dmp

    Filesize

    8KB

  • memory/1540-17-0x0000000077560000-0x0000000077562000-memory.dmp

    Filesize

    8KB

  • memory/1540-19-0x0000000077560000-0x0000000077562000-memory.dmp

    Filesize

    8KB

  • memory/1540-20-0x0000000077570000-0x0000000077572000-memory.dmp

    Filesize

    8KB

  • memory/1540-22-0x0000000077570000-0x0000000077572000-memory.dmp

    Filesize

    8KB

  • memory/1540-24-0x0000000077570000-0x0000000077572000-memory.dmp

    Filesize

    8KB

  • memory/1540-27-0x000007FEFD510000-0x000007FEFD512000-memory.dmp

    Filesize

    8KB

  • memory/1540-29-0x000007FEFD510000-0x000007FEFD512000-memory.dmp

    Filesize

    8KB

  • memory/1540-32-0x000007FEFD520000-0x000007FEFD522000-memory.dmp

    Filesize

    8KB

  • memory/1540-34-0x000007FEFD520000-0x000007FEFD522000-memory.dmp

    Filesize

    8KB

  • memory/1540-35-0x0000000140000000-0x0000000141000000-memory.dmp

    Filesize

    16.0MB

  • memory/1540-39-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB

  • memory/1540-40-0x0000000004260000-0x0000000004270000-memory.dmp

    Filesize

    64KB

  • memory/1540-41-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB