Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe
-
Size
6.3MB
-
MD5
7d57527905ad14e155231a8df5263f62
-
SHA1
2275831e86eac93e12af5b317931768fa4b7eee7
-
SHA256
61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728
-
SHA512
6d19caead5ff2476ff8300ff84a49957181cbd9507c320f3a9ac93ba459848b49852297aa67694fcae932599bcb1cbc9aea936cdb54b50783b89d6a81dda99ce
-
SSDEEP
98304:ziAO7aVn5SbWf+YFC7CIgc85+UAuq8p0cAeS:zC+lQaf+H7uc8QUAujpieS
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a0000000122ec-5.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe -
resource yara_rule behavioral1/files/0x000a0000000122ec-5.dat upx behavioral1/memory/3068-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-11-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 3068 wrote to memory of 2040 3068 61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe 28 PID 2040 wrote to memory of 2624 2040 rundll32.exe 29 PID 2040 wrote to memory of 2624 2040 rundll32.exe 29 PID 2040 wrote to memory of 2624 2040 rundll32.exe 29 PID 2040 wrote to memory of 2624 2040 rundll32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe"C:\Users\Admin\AppData\Local\Temp\61d927afed1fb81dc326e2bf2beb03a40e2e5256fa80a73219761e8caa1d1728.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,32⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe"C:\Windows\System32\SystemPropertiesAdvanced.exe"3⤵PID:2624
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522