a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe
Size

552KB
MD5

fec60d703c2dc1fd493fe16c7ff6fac0
SHA1

e5264760100beedf52886e684f15b5f84423be7a
SHA256

a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8
SHA512

23a7172d2b0cd82a542e83aec3a7375e02bc7bec3d3648c06b5a030c375afb04c24fc5fd8bc34a07a814cdd3083ed83cad04092f4983501f3bf24408aecf6309
SSDEEP

12288:Pw2VKYTnqYX09dTWbXv9BWtnFysQ9d87iBn1p+iG/8y4k:1KAnqYMdTWbXlenFQG+Bn1p+ftP

Score

7^/10

discovery

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000012245-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1328	a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1328	a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe

C:\Users\Admin\AppData\Local\Temp\a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe
"C:\Users\Admin\AppData\Local\Temp\a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\V220101109.EPE

Filesize
492KB

MD5
756242a8209a3f4a813968f2e771b971

SHA1
fe1ddade1cbfb7d78d5908e611757a3f401082a4

SHA256
eefa691cb7cbcbfd81dee4c433cfbb1e2a604f9316ea2bb9f391b601470ecff6

SHA512
b217cca747a7105cbae0932e723349de614430f90442fb91763dd5881c2dd2658f055be4b850f39d0fe5ecfe82555bf41adc6583298ad59d54392a5a19144c08

Download Submit
memory/1328-0-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1328-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1328-2-0x0000000071120000-0x000000007127B000-memory.dmp

Filesize
1.4MB

Download
memory/1328-7-0x0000000071120000-0x000000007127B000-memory.dmp

Filesize
1.4MB

Download
memory/1328-6-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download