Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 07:45

General

  • Target

    82dd41aabdd618e71c3220b4973e652f164f51f2ac59e575d8112e699b08cc05.exe

  • Size

    10.0MB

  • MD5

    5d1f2553a05ae47cb7de9fd2814af473

  • SHA1

    df32fbf6aaf753721628dc09150b3a5398a14312

  • SHA256

    82dd41aabdd618e71c3220b4973e652f164f51f2ac59e575d8112e699b08cc05

  • SHA512

    2a170c4227f6456ad4855bd63d7b37ba5d59bf0b35e87c027c1a068fba5936b40ae6eac6cb212e3ca8f387e6c7b6c76ad6e4f31ba1d0d1768195215920e0712a

  • SSDEEP

    196608:K7zFRdZtLdJXK1bIfPpd/1trVa41mS+cxorcZdqxIiijQQC6MYAuvNuFI:K7xjLvXKBWPD11uQfZ8I2QCvBc

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82dd41aabdd618e71c3220b4973e652f164f51f2ac59e575d8112e699b08cc05.exe
    "C:\Users\Admin\AppData\Local\Temp\82dd41aabdd618e71c3220b4973e652f164f51f2ac59e575d8112e699b08cc05.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SWM_SETTINGS\默认配置.ini

    Filesize

    16B

    MD5

    94a515b306e6228e8ce1d1795b5faf02

    SHA1

    5f6d4e1f6e98c0608805a6ead5c0a5d37205da86

    SHA256

    65ba2da2aa325358c44b42b1b002ae6717507eefcb42f1fcca4f3c480a9cf182

    SHA512

    8c84db3b0962af7af3a6a6ec842ec02cdaa9345749bfc1d839b6612dcd4b96e4a9ebbeab8afa7f7c24b242e9bfc1eae18b6689afb7ef071a89a22c3690099188

  • C:\Users\Admin\AppData\Local\Temp\SWM_SETTINGS\默认配置.ini

    Filesize

    24B

    MD5

    502640b26b032cb3dfc9c3d27947280c

    SHA1

    2f6b99cb033a68411a04c2a6959a7907438a4d46

    SHA256

    549b8c298bac30fed200a6e36a9499744d6231782481718fe28ba4e980c635f4

    SHA512

    21c60a181566fb64306dfbec67d7e00e08d7747e0a5e059cd98966a5053f74a3293cdb7fcb4ad6297f138d6c06a0b4522edf7e038136f0520f8bcb4bf47d7f8d

  • \Users\Admin\AppData\Local\Temp\SWM_SETTINGS\Game_Assist.dll

    Filesize

    105KB

    MD5

    ccdfb726cc8aebf76c9bc6f1341f5325

    SHA1

    4ad4d1f3c0423ce7757062467ab87a4dc1d48536

    SHA256

    fdeefa724abb593832eccdd6beab4b4fc5f51b210dcbc936c642d94e1ae43bc9

    SHA512

    66e53a5bcc6483c4f37d81379430b6e455931ae5c0e9561c16d908347af3021383c4aa2131ccffe9beaaba18599d5865efa3dfa2bbd427027261e27bf0e6a794

  • memory/2988-22-0x0000000001360000-0x0000000001D6C000-memory.dmp

    Filesize

    10.0MB

  • memory/2988-5-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2988-8-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2988-6-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2988-19-0x0000000001360000-0x0000000001D6C000-memory.dmp

    Filesize

    10.0MB

  • memory/2988-0-0x000000000146A000-0x0000000001A0C000-memory.dmp

    Filesize

    5.6MB

  • memory/2988-10-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2988-23-0x0000000074200000-0x000000007424D000-memory.dmp

    Filesize

    308KB

  • memory/2988-3-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2988-1-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2988-24-0x0000000074250000-0x000000007429D000-memory.dmp

    Filesize

    308KB

  • memory/2988-152-0x000000000146A000-0x0000000001A0C000-memory.dmp

    Filesize

    5.6MB

  • memory/2988-153-0x0000000001360000-0x0000000001D6C000-memory.dmp

    Filesize

    10.0MB

  • memory/2988-154-0x0000000074250000-0x000000007429D000-memory.dmp

    Filesize

    308KB