3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Size

10.7MB
MD5

521bf671850aeb99ef047b396c5a739d
SHA1

f185e582090fc2b441fc05abc24a85e9fce99960
SHA256

3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912
SHA512

8725b948c158b05d857d7ffc8a8dcfaedfbaaae06212b3185d9fd6d535b5384365fa9bbc387d17de0e12630fc8efc003dc52a12517f1ebcc35b459fb84e016c5
SSDEEP

196608:XGREIGCNGJSn4+rsivKB+o3pUv56toYB5beoCkiTbhaTub8VIH6Op7tB:XGpdNG4is56tjBleoCkIh38VIdZT

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000002326f-2.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2832	sg.tmp
2364	BCompare.exe

Loads dropped DLL 3 IoCs

pid	Process
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
2364	BCompare.exe
2364	BCompare.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3872-0-0x0000000000400000-0x0000000000591000-memory.dmp	upx
behavioral2/files/0x000600000002326f-2.dat	upx
behavioral2/memory/3872-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3872-65-0x0000000000400000-0x0000000000591000-memory.dmp	upx
behavioral2/memory/3872-66-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3872-73-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3872-79-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3872-81-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
2364	BCompare.exe
2364	BCompare.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeBackupPrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeRestorePrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: 33	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeIncBasePriorityPrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: 33	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeIncBasePriorityPrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: 33	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeIncBasePriorityPrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeRestorePrivilege	2832	sg.tmp
Token: 35	2832	sg.tmp
Token: SeSecurityPrivilege	2832	sg.tmp
Token: SeSecurityPrivilege	2832	sg.tmp
Token: 33	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
Token: SeIncBasePriorityPrivilege	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	BCompare.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	BCompare.exe
2364	BCompare.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 536	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	83
PID 3872 wrote to memory of 536	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	83
PID 3872 wrote to memory of 2832	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	85
PID 3872 wrote to memory of 2832	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	85
PID 3872 wrote to memory of 2832	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	85
PID 3872 wrote to memory of 2364	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	89
PID 3872 wrote to memory of 2364	3872	3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe	89

C:\Users\Admin\AppData\Local\Temp\3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe
"C:\Users\Admin\AppData\Local\Temp\3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:536
- C:\Users\Admin\AppData\Local\Temp\~7732720950072371547~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\3c83bec199ba5719497d846fd6fe228b8cb58eca881b5b7e83a27bc65efd2912.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~7812052378245086872"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCompare.exe
  "C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCompare.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7732720950072371547~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\7z.dll

Filesize
1.6MB

MD5
cffc09fd1030a7a2fae01b2890db0ea5

SHA1
85e5236e3d7adf82f0fa49c7bc94493f1886c9df

SHA256
e3feed937081b3e687b9b2e5f8b311e716ba06f52d573f82ba24e65c2deaff42

SHA512
1e99bd4d0ff4d00ddd71acabe2f0026f52a3f90c8af6a0157d47e9e96e97ebb0282acb1315e26a528c9740711604cf302d76717fe14876dcf43c9bf9f8561890

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BC4Key.txt

Filesize
550B

MD5
881760b96d1e01fbde3701f34351ec76

SHA1
d1ee291c3b28a68bbe5f0a733667b9a8b3c39bbc

SHA256
5cea4610d402c8e520696102ce6e400d3dc9ffc8e2727d29741141c1b803389b

SHA512
1ff8cab23cabc4d387490a85910d2428ec73a92ae3fcf4964291e99bb6390e048ac0b17f303f723de7955e6249cad59f0a1e7f01cb6d789c99838971aceb5d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCPreferences.xml

Filesize
226B

MD5
db35a0219954a55576190333a7f81b9a

SHA1
e5666092165970beaadc1c23ef7f9636ffb7ed6c

SHA256
95324a6d492efa7f1f34955f483fe9fa6b9ac19fc347cc7284ae24366b753e07

SHA512
a1746ae11ccdc4274d5ec99baa8ed20b9f8943720e706fef8834368fc1394ac08340818e0c90a18a1f5c87cf6be016ddffc883c91c5f21338e90d5f9131619e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCState.xml

Filesize
291B

MD5
bc051d6fd57cf2825fa1565e226fe21a

SHA1
fe999cb4c752b67d120b8bc89ea6f4b509493436

SHA256
73b59a31ca40160f75450637373dbbbf80abebfe108b3d5a7f5bbb69d1ca511d

SHA512
b1b86bf20d74df7bceb99a496c9f782e2c65e7ccb93234515cecac823f04b3b6e4015a673ad4bae86bdb862a4e0f6f3f8107bbfff38e55fc358ba21cdb934e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCUnRar.dll

Filesize
314KB

MD5
db55a39d3f2d7d976f4787e81951146a

SHA1
8695e4a9c175be90057f45d57f387939a0853e4d

SHA256
e7e2e4f7c153819bed0505ea8ad00b61b600b6c30488e46b685141b8124cdef6

SHA512
9704a852944465e16c11b391b992bb4dd19e70d7d5b719e6fb464e996efbacdbf9ad0eaa3c062a768e04d3404e9a75bfa043e3befcc525e46cc7eac779bc975d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCompare.exe

Filesize
40.0MB

MD5
5f3ac6e8cb53eeed718fac95b911b05e

SHA1
2863981cc8d85f46fec0e018f718f6e0ae3e299d

SHA256
78b7ba482871bfecc9e898d2735dcd198286f6a1a4f18803df1c4800e33b1262

SHA512
6d51b8865660171a36d9f92804dd9f824487798841392179c985e2b52aaba4941aafaa16d06f98c251fcdd7dd31994d0a2aa9c304930e8a715ff22f339dde130

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7812052378245086872\BCompare.tr

Filesize
434KB

MD5
dfb18f518d0c7abe78476674f33c7d53

SHA1
c35980b3091738a5d1a3e3a24ef1e6948aa1dbca

SHA256
f3d19e37b9d7bd4962b6e63798d74b4d966dfa929e97a12e65bc8a54d5ec7820

SHA512
adcf580245d2b443dde2e4982a53a5137900ef507ccd5b8c964dac73cf8f73e9ee8df92ec6f76fb8e98ccd2661e4731509f2e18a3c3eb7c4028e4b116c83a519

Download Submit
memory/2364-53-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2364-52-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2364-56-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2364-57-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2364-55-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2364-54-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2364-58-0x00000000067D0000-0x00000000067D1000-memory.dmp

Filesize
4KB

Download
memory/2364-69-0x0000000000400000-0x0000000002C28000-memory.dmp

Filesize
40.2MB

Download
memory/2364-51-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/3872-65-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/3872-66-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3872-0-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/3872-73-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3872-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3872-79-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3872-81-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download