Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08-03-2024 15:28
General
-
Target
bddf2bf7584238ba774472e8fa4ec4497bde754d6db76ba1b618cba42cd6505b.exe
-
Size
14.9MB
-
MD5
0979c4e5efd41d43730ea796b700f507
-
SHA1
a7c45889acce29bb90c30ada87ac118c1a66518e
-
SHA256
bddf2bf7584238ba774472e8fa4ec4497bde754d6db76ba1b618cba42cd6505b
-
SHA512
4ee0da1aafe67cc996fceb67ea75323df1e8a7ea19fb26d0ae67285d4dcccfaf54cd93f2e4c2de4f32a446944f963514dc600d73cafd626f85943a8fcda6f60f
-
SSDEEP
196608:GzZT+/iL7ML8mDn8X8NSHdoH8W3vA0Rrwt+WqalPB6oJvm1QJV:Wy/iUgQEBW3Ycrwt+b46c
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 42 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bddf2bf7584238ba774472e8fa4ec4497bde754d6db76ba1b618cba42cd6505b.exe"C:\Users\Admin\AppData\Local\Temp\bddf2bf7584238ba774472e8fa4ec4497bde754d6db76ba1b618cba42cd6505b.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\·ÀÆÆ.exeC:\Users\Admin\AppData\Local\Temp\·ÀÆÆ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5acaf36d6b9fa9aa3f7ba9be68f866c28
SHA182b5a9fd6fa94d1e21036db9bc1843f55e7f55f1
SHA25644ad8beaa498c520f0bbb793ecc51b2b9566ba85a46c4cf5ebf6014b0b91c16c
SHA512bb393831048f8f71eac3a6628d9b330d1e8f129dba35f264ae650d1543bdc8e01fb0f3b7eb9bcb4181c918a49ca49e6fd2d82663bb2ec8795c0b04233942d4b9
-
Filesize
724B
MD54631ee11aa9344bfc6eab44c48bc750b
SHA13ab2d4616ebb3309f054f26550628f845c1c4435
SHA2560357a9a34c9f32c6653e2f933c662b6c13fec8c7d9c26119a819805160be4c0d
SHA512e60694fa3f552bc11cfafcceef24941cac8ffbf009e69606dcfec81a63d46d67e50236cd8957faf0c804f7b5fc6e189723c5935d1dfb2134aa94f7ca82e422f3
-
Filesize
1KB
MD5ae3295cae8956a393fdf09f412c67511
SHA1a282e2f233e11a4ecf2c5492ae917cbe105c2e1f
SHA2564a4707a615710ea35f20a0377db096c40d120ecc540e613bb268d9e82b4ebb9a
SHA51230bb0213a1b02803a5eac2d4c50f21695ee5f3e74a077d2d84c9fe48f9ab6572931f5d209f3c18cf9be4fea72f3df4963e136f69272bbf1d69f17c1a4a7fd377
-
Filesize
808KB
MD54737237d2897ee8ec6c4b002eba8326a
SHA1656c67274a39f0e8d298b9603e2186cc99e9465d
SHA25659f545ee8d18155eeac53f949a86caa5f688edc58f59b29eb7d7a440251ed04c
SHA5120754485cb1b844d8113e09138814dfef91c19402f53a6ff798cb4b8fbd9c7351091d6edac8a0c2dd421ae4c82130998d02cf1054409527b9f17e916f5ed7f8f0
-
Filesize
704KB
MD572c2c804d4551df519aa0daacd1f7fa3
SHA13ae900819cf5af5618c4aa21908aebc1ad1dba50
SHA2566cf7dcae966d50566de67e992e8523173b7da6b4ff32d9d7377e0f293edcd977
SHA51206f2898ea3655010aefa5f405c0952bf695a62822ec56c003c69db2e4d9e0260a06f0af9c8453beda84e64197116aec364797466e020922abc3f3a09351a61c5
-
Filesize
1KB
MD5a81ffd0db77a3c9940d1fcdc77dfeb77
SHA1ddb26126b9b2b37792edc846307fe73b131e6ccb
SHA25672d84a817f662674b8209735468713f18f7e445320dfb6395f2cab02bd4898ee
SHA512cd8e945c834658a9e1e9e6c0c32a873a5cd65af715da2b3a04d965a21d508788add90c3b90f265e552a6d45cc360eb6f121857bf279dde1697dab29138f80f1e
-
Filesize
1KB
MD553f81027246df90f1b57a5756b2ed30f
SHA1ecaec75ec3880dd47952ccb1c8ff818c36e0c833
SHA256ef687a750ce2bf54cea8558af3ebf49d9b9a90fdd130d944588ac728405e0919
SHA51292a1cd476f2121b9f835f65e50f3308e0ae5e913f18956da7d7d927851a7e7213e9447a83a0b1e630ba966f1d725011b46920c83b00bcf2d544245243627655e
-
Filesize
1KB
MD55bb26ac226884040f153863dcc29445f
SHA13cb394d47bffbb8896837da33876609879773992
SHA2562b12dfe7531f78528221f706a2cf87dc3f58d36d97e1e0f542a1991e49f627f5
SHA5126064cd1fa6390a24cbc2a0946a5e79aa0a5a470983b0045657ff7ce5227c17b940aa2113417db7212c20c513644ac31d79cb85eaf5b7b6ba4ee92459823628c2
-
Filesize
1KB
MD5c41183db3de106cb48a5145514090792
SHA1e568cbcfc0b82e8e48da9d26430ca31c20f85059
SHA256e36564d2216ca602c9635b1f8b1983ea287fa79431ffcb1131b21df7e64d1c12
SHA5122c3c0180ef24cb79830e11fc90e3008ff721726e0439508bd4c5ffbe0d9464c03b8e3218ad49a0ec39ab8e041ab0f5647b072c0719573d3d35b8a0eb003de1a8
-
Filesize
1KB
MD5c31798c00f2604ca5530b6baa373bf84
SHA1d64cfda28a0bcf23f2c1bc1257f5371c66abc646
SHA256d0e44e3a6851e4332257feedc3c0569453f11ddbc8e4e958271aa7cf736538ae
SHA512b4757891638c3ee4e09a28c3f797c33e8443309f2d9c137a3de9bc1227a0631442e829a81076a6362ac73d76d809d589b447c574f0141854e253691e25195367
-
Filesize
1KB
MD5c1b2b068f54357d27fd31ce3013fd24c
SHA1d08a1cdd9839285040344021475c6d4f2860251c
SHA256679951d109cc0bdf0cdd3493836ecac90afb9529b1428ca84f69b1843e9d2269
SHA512120d6504b0c0c0ac2df7352ac6bc3f0a5d7ca8b23577e0fad3d2bd88977dc73dad4b33496f3a8489a249b1c66fb1b6de23a18b1202701dc0b766e6aa5b5c9c97
-
Filesize
1KB
MD5433cc51d269764514f72bc6781b1cea4
SHA189d0b92fe94d25ed808274d73e089958b6d8e4cf
SHA25617191d8acfc68474499252598b451b7c49de8e5ed0433269d1bca12b1a90d21f
SHA5128dab9cfe3069c5b9b91cdf82e62eaae9de25e51946ee7e1c3e423a883277994efe4a7365ba889443e930e656fe5ab92e03b93efb0d1a00855acb13fb9c5f44ff
-
Filesize
1KB
MD560fadbce4fdb0e00108851ceaead3e69
SHA191c6f4ed679b683cf95cb83505f99a78e9b925f0
SHA256737332d16b23ae7def46f327d183e3b9b765c2c8e987e9abc7a579869ffb3725
SHA5122c51d96f3a41368cb80d256f97081c9bbbee9b360c951f911a230d2269e7d792b9d4ae9ba5b91af818f56d98922a9157b74fd2c65735101b8b998c99293d9b7b
-
Filesize
497B
MD53b91f0e652f9bed870dae4ad079437c0
SHA1bedd22335c4e61c42bb0df0e30149b2330346b37
SHA256fec840b8a70249079092a8237adfa1ce3f640354a2dcd60b5c81ccf62aee48e3
SHA5122b4491744df2238cc765c58f5ce3e6e6ce787e9062f69f76c4a8adb6dbb762f6a8ee57e40b4495ced1db93afc51ff912f20d8b0fd52f33b96960732293983a39
-
Filesize
1KB
MD5fb37429e45792fbb1a30f6102f62d5b5
SHA1ac40bed9025c86ecf77c1a4a4d5463bab0ca222a
SHA256218d03288f3d697980be189afeea15dfe430c17f0f3100abd0738ab2337dfccc
SHA512a7c4cdb00923b87124512bffe5cca2b5c3e4d8115431264f452481fbad532f6d69b7c6be26ed67bfae083203a8d0dcf81d32f620f1efee212ea29da9f10faa0d
-
Filesize
2KB
MD51f100ca2d66b6b12ddabc1ffd178d22f
SHA1da01c70e9464271cb32bcf36990d69871cdca395
SHA256c7bfa2c444aa0f1e05419a222627d975847baf9c204b0643aa26c7e777a5368f
SHA5127c7d96a559bbfd0ac285c01b01d64253eaab1f9446394f725a1003ce359b8eeaf4c91e16c4d37a9b71d213f20f01bc631a431ab2d2be80fcad478ec11ce06a03
-
Filesize
1KB
MD5b509deb9b25ce94ee1a5c09a8d7c7263
SHA1a93f11d8f80cac305eddba45978ed9c49546013b
SHA2560ebc825dd67ea0fb3fc8f01e5025c3c9b70b6add6d50d170fad2ef5928d73db9
SHA512974b58d7c0111a7a38ff12036d3714995bf0c123b3c294e0216ce51c05db1673e41158768cc6e22ac34ecbb73c3484765d1a4307ee8877cf4515888a0f14f74b
-
Filesize
1KB
MD51cad72b4a95eae0d9dacc86c687f1a3c
SHA19ece87b174336aaafcb947a22a900cbaa903c8de
SHA2565000461bfcd7f500418187b540d8e577c430004662831c8917d81e988fda4be7
SHA5124d0cd779c8ec38e9d9d98141bc871f5555ad43ba2429a7cf145b95ad12b95b9435d10808549c551ecae4f69384eac0b2af8cf599a5809551732e053d79f48e80
-
Filesize
1KB
MD597e904d44f15963291ecd7c622425a3f
SHA104c4469e5e84c6c6d05922050295b19050535594
SHA256b1d9bc8a0e733dd0c48c6acc6fadce1311b26a25f15dfe9a185a2282561db73b
SHA51295fbb8fe4f3f933468cb68c28e855f91ff9dd355aa56ffc1165cd6a545548a98d85ba785313dea99a48d0c9fde590711d2bed4398c848dd6e1a5d15b065a2ce3
-
Filesize
1KB
MD59f104a555a2a847baa86b37c2278e832
SHA1c829bc86c5adabdff0ad239ad827cb4d4e11e6b2
SHA2561449baaae39493b29428e0391e95e5f9dfcade1e0c92f72b40d51ee67a30c0aa
SHA512dd50cc89c65060223cc2668681bb8604947be9e0ec0f021f71331dbfc8ba5c424b65bee48694a0541ce4b8d3b35af1d93e17006839d56d9ff4d86a1b66507668
-
Filesize
1KB
MD5f8d012817f4ac16482507c671b25cc32
SHA11ac49290bf06f4b3023b396aae4b8a4cbd54cd51
SHA2568da3a1fdb43a533b2304bdc07658675574a5bf87d4097223d9ef1fe1d2636a19
SHA5123812b6b17c9e5ae689befcd3b371f7390c94c75acbf09b19ef783dfbbf038f0837bc317cedf0cf0264096e6ca09275703bf6f251a1857d29725e0c280c70348c
-
Filesize
1KB
MD5a93e988cf782000de7066264e7d2d8cc
SHA1329009ae7fb06dac130adf37c653824c288a576a
SHA25657ff007e30ae3cbb1905ea2d9f11e7d7bf135d33638a3590c6bca7cc89755163
SHA512a5a494bf27c9ad967d37e4b2a65b8b25f0df475407e64b522e280089fdc5d069f181e991a26eb6dbf712f053e673896e1999bb56eff1ac24848562c0760b6871
-
Filesize
1KB
MD5963f0b885640a11343ddde3314b8a317
SHA1f1c5c2729740c07679d73d89f21e6a22f2a36bf7
SHA256b582e9a8d383e2bad7cea257ec00ed8d525b84340c2da7cee3c7cd45e4bb64c1
SHA51241ce4673b6a261b68f607b48a7ed3806550995033055efa83aec4ffa4028fd5af26bf427db86446764fe7228fa5ac9a60cae00caf3397987faae4f50640b3745
-
Filesize
1KB
MD57ae8f778257a6fa9329015255fa81546
SHA102ecfdede6b359cbbc292c3c9ecf23cfebac0fd9
SHA256f64c2cbf17b74141c3b69a78cf8f1c3388a65909a7dfffcfed619daae30ee755
SHA5122963210f085e2958f6824d18441cc4984a6f755a29ceba8fad7cd3c761f9a8693f9608b5600ffb9f0c745f88927f960a24b5b16324aea1ce0d129c75bcf3bb33
-
Filesize
1KB
MD51a8278cea3302932be2725c94241d189
SHA1c53d5e4f91c6efefd1799b0258d20b2db6b565e6
SHA2564ff18cd16cf73232e9ccf93ab288c4ef06902a9f05b686e9a2bac4817bcaac47
SHA512f5f91dd882c08ab16476a9179fe28b004a32cf9eb75263620cd83c1e4a6cc3320298187c3c2369242dcfc5e5cd2983fbb5ad1895bc52f07fee6fb1c7433f11cb
-
Filesize
1KB
MD50eabbdcdde2d18316a916ca952c123c3
SHA152254e92f2eee07342da99362d391cfcf4b0a0b2
SHA25655afc2e7f579741db2269d5cb46092b12c52a3a29a44886a35702e09f0581fd3
SHA5121943cb7401329d916ac6279ba212d9b148e08a5b802b4ebf6884fa9979a542927d2205e7a39f89e874a83938dc3176a5a5209f0893f8f73e1efd42e049d2c0f6
-
Filesize
1KB
MD59d1fa873f4f2a45c569d8baecf213c3a
SHA1f1316dc1cc7d723f19804ff601ec9374e2086dfa
SHA2563c711ffd8c149fb92d40636124382aa5c4fd7b83f3b5ff7412657dbdeff8d162
SHA512ddadb5c986cfe8f1507006777f51af295148afab4278d17754b5767510a9cbc234214df2fd7c62d9145b1f27cdd051d75f2a2fded7f0aae2234da841732cb44c
-
Filesize
18B
MD53458da125b652c8c7ee822d9949c0773
SHA1d31c5673834345d0e3121ae2bbf9373d7ac5fb73
SHA2564a12020f73dcd3e0fa4a8482e2d9529b9a5e5ec56b07918dd6bf611912801f48
SHA5123cedc4892598d06b246e3c5fa30eb5761fe7e3953064815ed684dcc6aae9451ecdf92d765047fa3f64fece7cee84d2e7656bce933280e51f8ff17b35f2ae04ef
-
Filesize
48KB
-
Filesize
4.3MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4.3MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
600KB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
48KB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
248KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1.0MB