Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-05-2024 13:22
General
-
Target
c2a5c16519d9dadc1ad0454b7fe77672856bcbecc4cf39eb5d7bc89491e6d9f3.exe
-
Size
10.3MB
-
MD5
6b7c72e705f070fc34440815bbae677a
-
SHA1
03902c706a6da6f4c87015159694a30761e33f60
-
SHA256
c2a5c16519d9dadc1ad0454b7fe77672856bcbecc4cf39eb5d7bc89491e6d9f3
-
SHA512
0ea9ba95adc920941ad3693c27643900eeb12928e22a47c35611548fbabc06b4c4fcdb6023df757afd8b48440459ada3299cae53b7b65a3792f4f55bc67da811
-
SSDEEP
196608:u+Ft+tfmD4XF0ebvjXsrq0Xd+b9VmBrS4usDEh7VB8PuYmfADv0UP4gQ0jIyKiSK:V4Ktebvj820tuGc4QwSADfP4gQ0jrKdK
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2a5c16519d9dadc1ad0454b7fe77672856bcbecc4cf39eb5d7bc89491e6d9f3.exe"C:\Users\Admin\AppData\Local\Temp\c2a5c16519d9dadc1ad0454b7fe77672856bcbecc4cf39eb5d7bc89491e6d9f3.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5be702be6be99ad2203d50516014e5cd9
SHA1b4842827e5bc9de24e74d5b08afa0675df570dba
SHA25602bb80610621625b0c420a9fc8ba32efeef4b859b327aaa0dfb62da38abbf41c
SHA51279cfb96a73ec2b8341c59580f7ecd5db53b5023e41acad47e6e8bd8350532d1c4dcb04c1e62bbf3bd149b1779ed904b271bb1b9fb23c6fed1752ade43239f9a8
-
Filesize
80KB
MD5b220f0b3057a925147f57c5ebff51523
SHA1bb9faca3b0e9f849301ecbd58381e7965a143781
SHA256f12af891c0c1cb5e793ab260ff92e9792c8f7f2541162390a44c27e2e954dcb8
SHA5121e9fb6bd6005aab4f553b0a02c373671ce26fa773b06461e0041cfad0ae62bbf319105296ebd5e2c1ccf1c478ce17510aeb32dab8b83254fa2a18c9148f121f1
-
Filesize
4KB
-
Filesize
28.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28.6MB
-
Filesize
28.6MB
-
Filesize
28.6MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
4.0MB
-
Filesize
28.6MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB