Resubmissions
21-08-2024 19:30
240821-x76q3sweqg 1021-08-2024 17:42
240821-v92h2avgpj 1012-06-2024 16:01
240612-tgps4a1bqh 10Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-08-2024 19:30
General
-
Target
3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe
-
Size
41KB
-
MD5
3e67d212278e1af5be913d236399fcf6
-
SHA1
f993125ed4af1de6a551a6e0843a6d124cd46f27
-
SHA256
3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464
-
SHA512
f7e6394c9f9fdd6a03c72aaece5b4911cb821680a632f94b622b12d94cff9873d93b2c6604016524bdab4dd6e4b70b532c440f6b296138677be19e078ad23ec7
-
SSDEEP
768:/eMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09sy:/q5VwWDjDkdTRqHFOn8tIbbeYiuZIFSl
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe"C:\Users\Admin\AppData\Local\Temp\3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 9124⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2e44171d43e75144fd265a82047a50c
SHA13841f53c6ed5094ea717d347318b2bad008642fc
SHA256732880143216a0f88ef558aa80d306cca9f25f46f096dbd647940d1bbccfe541
SHA5123655a2b496aab362a421842f170fe2676be2bb0d2cbde73275f5c0c31316434336533a04d876843ba6151fa534f84d11c8467a07e8e23a8198ebb584eeaeeaa8
-
Filesize
183B
MD53ccc9d123baa59a6cebdd81651dd685d
SHA1248845e55145ab56c7703e83cf6cb2bef233b2ea
SHA2566ed4742198b26cf02862e86755854fce69d85d07d1d5a3666881dfa6d2f2b697
SHA5121a239b67768ad0c40caae5f27851e37ede5fb9f6fbdd56f6919be7e8480909951165ae1c7512bc9ad60023afce928dccfb7bb4abac4409031f96c7329da32308
-
Filesize
41KB
MD55d7caedb961499db3987ac9373ec5d27
SHA1dc23ae8080f515bfa5e8f20f8048338dd14e84fc
SHA256f27776a69abbf558526d3e00dcfd46c8ee6c44903db3c2fd302fe46754d5c481
SHA512b7d946502102e94ed06816e091ef2156634f5f056a2262a72c5ab6d0c9a1417c723357983a7dfec8dd0079766ddf8ad73b43513d7eb18e779649a173b6ca65e8
-
Filesize
8KB
MD572c65e63bc4c23ac2665ee15f870cc51
SHA1a87a159e392dd4f27956e482e2ae47561a9df72e
SHA256bfcc02351c872200aeda0a6cc79f505e6a1bce450f79fb7401ba67ac9c4af566
SHA5125e50232c50c71686c24215f2cc634348791471866b453cec9a045f1abf4cf393d63c9b4feadf7aceeb52e9584907eab25f8b14bc2e4d26e399642e2fa50a0978
-
Filesize
52KB
-
Filesize
36KB
-
Filesize
124KB
-
Filesize
52KB
-
Filesize
124KB
-
Filesize
52KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
52KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
36KB