Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 06:29

General

  • Target

    b6a4eb41f4b5abbc146beb7e8d019e6a84ad58e948888b29e98b4204b10d331e.exe

  • Size

    6.0MB

  • MD5

    447b30f57c3225e9b3da6005d80cf4e1

  • SHA1

    2eaf955d1352dfe97725405224cd5fcf69b882a8

  • SHA256

    b6a4eb41f4b5abbc146beb7e8d019e6a84ad58e948888b29e98b4204b10d331e

  • SHA512

    8cdc2f01d540aafaef54c06039cd3aa46ad47fe1f7e3a7f581a150bceec701dca9cac57f66f1760042a1c79855d3e20b3c874fe1deccaa45919c339790597547

  • SSDEEP

    98304:ThVOYRYybVGu3shy11XQzJUoKyXENZJ3o/lpJ6kMUUCS5sJGeOzUgxB+1SO9vk/D:ThxRPAu3sheXQxPEDulp0kYPu0zYg7Yq

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6a4eb41f4b5abbc146beb7e8d019e6a84ad58e948888b29e98b4204b10d331e.exe
    "C:\Users\Admin\AppData\Local\Temp\b6a4eb41f4b5abbc146beb7e8d019e6a84ad58e948888b29e98b4204b10d331e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5264
    • C:\Windows\SysWOW64\cacls.exe
      cacls "" /e /p everyone:n
      2⤵
        PID:2160

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll

            Filesize

            233KB

            MD5

            ea3df059beae86a3e186b2b179755e77

            SHA1

            babdcd6b5082c02fa2f5ebc2020f2cb3bbd77e8d

            SHA256

            1ab68a0c296281437fe638c8535309c6241ded4852608d940f5efcb8cc2d91a6

            SHA512

            1406d8083cfbd26e18aba74f6b45a09137bb3960f7afce5c5d0d790b0edb7277b7b885ed2ded9def12b667bcb37cbfb335884b2d7b8f08565743b674d1f053bb

          • memory/5264-0-0x0000000010000000-0x0000000010018000-memory.dmp

            Filesize

            96KB

          • memory/5264-2-0x0000000010000000-0x0000000010018000-memory.dmp

            Filesize

            96KB

          • memory/5264-3-0x0000000076209000-0x000000007620A000-memory.dmp

            Filesize

            4KB

          • memory/5264-4-0x00000000761F0000-0x00000000762E0000-memory.dmp

            Filesize

            960KB

          • memory/5264-14-0x000000000A110000-0x000000000A1AF000-memory.dmp

            Filesize

            636KB

          • memory/5264-13-0x000000000A110000-0x000000000A1AF000-memory.dmp

            Filesize

            636KB

          • memory/5264-43-0x00000000761F0000-0x00000000762E0000-memory.dmp

            Filesize

            960KB

          • memory/5264-42-0x000000000A110000-0x000000000A1AF000-memory.dmp

            Filesize

            636KB