b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe
Size

461KB
MD5

fc1d45faa27a9f5db6d5b589b326322a
SHA1

fffdd956d880ab4b8420725dc440777c918193b4
SHA256

b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4
SHA512

1c5cd9bb2ea26c781c087cc22b0d21a914db58aa72f44d1b2a141aa8677672fcaab36644f97093ec9bf43aff1057030412c735adc235e99f9028d447144f272d
SSDEEP

12288:SJRL3Ubb6U38Y9de3ANbCS0Z8M9exenVWqqPIBONhxs8hmhSBjvrEH7o:SJRL3ap9dNNbCiM+1/xs8hmCrEH7o

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023260-1.dat	acprotect
behavioral2/files/0x0008000000023260-57.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4152	b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023260-1.dat	upx
behavioral2/memory/4152-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x0008000000023260-57.dat	upx
behavioral2/memory/4152-61-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe
4152	b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe

C:\Users\Admin\AppData\Local\Temp\b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe
"C:\Users\Admin\AppData\Local\Temp\b0a91753a5b0a76f3fa2c5c82fb0da1dd1f6f31bd8ea31c78cabdd93c698e5b4.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
64KB

MD5
2bbf52ab0cf0cf3f70ade185ac65fb59

SHA1
8258f662b485bb5920ae1f6720fd353421d0a39e

SHA256
bb70bb0eeb0a74d007f01eb2d4178ae9bc817cdee10c656b7f8747b424604147

SHA512
367e8462c02426d1e4205f9666e61d9c59571ad6ce68c7333b1deb799d32a0597f31e73ed9f1d3d790f35156b26051b44287f7e424f9c7eb2efdab1c35a20e9d

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
2KB

MD5
cd8b96df16f93821750cf1821d812b56

SHA1
f4b35e9e44fac9e419d0977c169e0ef82c5dd92f

SHA256
f53f9a6defdcb7fdcf3bee074caac972d7a02676c3d31af3924ec58d31a852de

SHA512
65bd0539a502c3f258efe22286b7ad9f87cd20b113f000aad278e55559a6a13ca9eaa9a7b96b0d2edb8fdd0cb8036e83ad3ed38dcf2dd7e94f09eecd45d8f24b

Download Submit
C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
5KB

MD5
59616ec975404734d52005ee29232b19

SHA1
58bb1ad4b10af22cd97b2711348097394b182826

SHA256
8887e4a9ce761613588b17a1b5d82f0cc7ccfec7eab86a420cc07e7f0c92f02a

SHA512
98e2182898ef9a23fcf7b2b71dfe9a41e04045c88ce94a1d5e1ba1c8d554e64bddc5f289ee3e040c17d16090d2864b5f9e65f0bad4456e12a1a4d422ae1d6c33

Download Submit
memory/4152-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4152-23-0x00000000003B0000-0x0000000000416000-memory.dmp

Filesize
408KB

Download
memory/4152-60-0x00000000003B0000-0x0000000000416000-memory.dmp

Filesize
408KB

Download
memory/4152-61-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download