Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10/11/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe
Resource
win7-20240729-en
General
-
Target
5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe
-
Size
2.1MB
-
MD5
e144be9a5d4ddd933e2607f635901ebd
-
SHA1
6ce2ef921aaeebd8b16bce77098de981664857d3
-
SHA256
5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42
-
SHA512
df4977854dc07b9993aa31c65f025164cadd10afffad1b84aca6119c5a3bc280d480e1de50485bb31d58fc1be40fe30d370d7765ea13d691eb309254e1d3c96a
-
SSDEEP
49152:hVL2yTWaGJnzgjq/9hKspfzOiMeGPsBVPmjxcuE0D5K8Da:7LHWaHYKspf9lGEB5j+tO
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00090000000122cf-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/files/0x00090000000122cf-1.dat upx behavioral1/memory/2636-3-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral1/memory/2636-13-0x0000000000390000-0x00000000003A8000-memory.dmp upx behavioral1/memory/2636-18-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral1/memory/2636-26-0x0000000010000000-0x0000000010014000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeLockMemoryPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeCreateGlobalPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeBackupPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeRestorePrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeShutdownPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeCreateTokenPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe Token: SeTakeOwnershipPrivilege 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe 2636 5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe"C:\Users\Admin\AppData\Local\Temp\5b696394b74ff55bc8edfa800552abfb3dae5228a2d31f7fdd0fbdf5e4ab6e42.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14B
MD53d0dd1232f57d57872560ae8727c5a4f
SHA1dadcf52337f2269136e962347cc6de9ae7912dc8
SHA256726efd919301fcc5803fbe842a634faf8be2f5273a2f44e73b714ad47e92353f
SHA512fded1e797ebf90a671cb0fa50d73962cc039306b7a66054e87527d044ff44c2d36d6f316e1d72f81db0856a70d88dc1b6dd154566a1419f0a0daa4917d4b9d8f
-
Filesize
27KB
MD5849e9f3e59daf750db838e885d58c6fa
SHA1733cb105153e4b83160a52bfa2ddd95d750fb806
SHA256f94949a6c121a525f661dd8abd917eb37a5cf582c89e3a258170a15d30cc0cc2
SHA5123feff6db5fc5ae371a4ec60ce13a383668a5accac537a0ae56b9b5b7318a2d5bdb4b79286a519cad3610cb6d1f335a11c09a4d3165c147a00d5a7880ea23e173