Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/03/2024, 11:58
General
-
Target
e427e764efd931d2750c74f423292018ffb228724d56d3318155fc9d62bdd9f5.exe
-
Size
3.3MB
-
MD5
96bb66bb94492869f3e7788ff4a3a35d
-
SHA1
4b34bf128d3848063789ddc4bb2e19b523afb4c6
-
SHA256
e427e764efd931d2750c74f423292018ffb228724d56d3318155fc9d62bdd9f5
-
SHA512
30dd67af9064cb0c331409f03fa6a41b4428800139e6ccfe1b06bf6b95f89b789c16a78428a2cd64a99900e2626c49b4e9c3dacda73e8db382bc6e5bc05fb7e9
-
SSDEEP
98304:daFG1JbAC8so6/O2PHyVpooHGL4ygj3vAs6l:xj8NSHdoH8W3vAJ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e427e764efd931d2750c74f423292018ffb228724d56d3318155fc9d62bdd9f5.exe"C:\Users\Admin\AppData\Local\Temp\e427e764efd931d2750c74f423292018ffb228724d56d3318155fc9d62bdd9f5.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5acaf36d6b9fa9aa3f7ba9be68f866c28
SHA182b5a9fd6fa94d1e21036db9bc1843f55e7f55f1
SHA25644ad8beaa498c520f0bbb793ecc51b2b9566ba85a46c4cf5ebf6014b0b91c16c
SHA512bb393831048f8f71eac3a6628d9b330d1e8f129dba35f264ae650d1543bdc8e01fb0f3b7eb9bcb4181c918a49ca49e6fd2d82663bb2ec8795c0b04233942d4b9
-
Filesize
2KB
MD5a5fcd39c6abb106243ed77a7ef31f406
SHA1f52010493b4be7b2a5ed1a8d108d7d06800b0fae
SHA256b74be6199aaff0f8e146d2837fd499675e37832c5837eec094a4a6a826c9c02b
SHA512bae1f9c3f901351736404065fe8282cec3f1728cf5d116fc53a3634e879d508297a5c46259b1619b576011eef3eb8560505de6f2d9fb281fbd643a02aff6c07c
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
600KB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
48KB
-
Filesize
4.3MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
48KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB