Resubmissions
18-04-2024 05:22
240418-f2z8nscc74 1018-04-2024 05:22
240418-f2njwade8w 1018-04-2024 05:21
240418-f2gfkade8s 718-04-2024 05:21
240418-f2csdacc53 1018-04-2024 05:21
240418-f2b6vade7x 7Analysis
-
max time kernel
298s -
max time network
303s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
18-04-2024 05:21
General
-
Target
d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe
-
Size
371KB
-
MD5
bb8cd5df2be7e8bcc5be439675b3d0a2
-
SHA1
627ac60f64974d5caaf81c2de8ca0977c91f4219
-
SHA256
d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a
-
SHA512
57031eb7d7b2c27d7ecacdc085d07065ced46a742128f9818f62c9fe6633c31aa8eb20ffc52c8415613787946060f5a6b5adf8b977d5ca4fed9656233ebd9cfa
-
SSDEEP
6144:tnzQnu/cmM1oSigOQT2F8U92Iu7DMVQZhWLvLRXdYX9ji+uhi2PsrhY:hzQnkM1oSiBGI8bxn5m6i+uo20tY
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe"C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.rtf" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
4KB
MD52d5020c82de674b48cfd17cc20fcbba2
SHA14e317eaeebd839ee5f6eb3925a9fbee819c5349c
SHA256120becd55248f4a2ccbbc99ba9d3c2932223264a95cd72e9ae7568be61277e9a
SHA512ffbbdda009237d6825f6cd6f751a41f4f9d716186901ffdbeed56c2d1410245771decd07f591cf56cafdd4bbebd4e4c74f009ff15736d5321635e34ff17d0d8d
-
Filesize
388KB
-
Filesize
352KB
-
Filesize
388KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
352KB
-
Filesize
388KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
388KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB