Analysis
-
max time kernel
117s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 06:23
General
-
Target
b2dd824b827d7164c05b7af8cc56e8dc37eba4ecc2b5aa4a3cdbb6e85aaec0c1.exe
-
Size
464KB
-
MD5
92bbf2690a68619a59dc7aa5992076d7
-
SHA1
0f2a7fb4a94bf6e8ada44979d38b59e145e6e5bd
-
SHA256
b2dd824b827d7164c05b7af8cc56e8dc37eba4ecc2b5aa4a3cdbb6e85aaec0c1
-
SHA512
bc16dea997480044b2702f3d96d94689748ea5cf82f26952ee0933e4a4653e0fdd6fd053e323c42a22894c66f307cb4e5fd82e44d696b6c2fe7175ac9f6f73d2
-
SSDEEP
12288:5K3SET78X1JBxkSYnVWqqPIBONhxs7rleBjvrEH7L:507T7E5j/xs7RYrEH7L
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2dd824b827d7164c05b7af8cc56e8dc37eba4ecc2b5aa4a3cdbb6e85aaec0c1.exe"C:\Users\Admin\AppData\Local\Temp\b2dd824b827d7164c05b7af8cc56e8dc37eba4ecc2b5aa4a3cdbb6e85aaec0c1.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
5KB
MD554d364e4fb5651ffe6f6ac018dd562db
SHA1a73b18820f72f79711de530d8b6791acfdcd644f
SHA2565b3a18b0d79584ed0961155b6863b21482e3014217e7d0fb6b3de3ea318c1599
SHA512386260fd85c99b85d278cf98a2466d3c1d7693bb359c628ff6dc469ace89fc0983ecee4866c674af854050a70c4f56ce0c4fdbe43b6734701d1dccb1d6a722f0
-
Filesize
826B
MD5323de4e65485d37920123ddcbdb2f069
SHA1b115cb480be066570515c294f6eabe6878327e33
SHA25641b3a93bbbe5fb936f8cc7f629bbe0f81febd8fabee9c6529f786fd300299847
SHA512fa108ee862896868f9f73a0e8abe04319b57b5449ac3ef25b6745572938c4a62dc8f7ca259949412096e9f7fb1f73a5604aba21142a67a860784f31c3727dd5c
-
Filesize
192KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
408KB
-
Filesize
192KB
-
Filesize
396KB