Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-11-2024 01:25
General
-
Target
a9f3b8a813d7077825f0c17f9cbcff86ca1b883413675badd7adc00d5221dd01.exe
-
Size
532KB
-
MD5
3c00accded5db6b17070663be4e2725a
-
SHA1
680d4a496abab8e1a4c61ea0e488dffab1db1416
-
SHA256
a9f3b8a813d7077825f0c17f9cbcff86ca1b883413675badd7adc00d5221dd01
-
SHA512
154317933533fc93d9e50c9a2f23682a90b9014dd317f34a5b026e9abafc3561ead619f5642ec1c3a50a7640020623d2cf57b360e9ae1f8e1d2f6d4b63bf7abb
-
SSDEEP
12288:gCmLpJTyNXSYoGkZCOLpn45/MQ51dqhkKq:gCmtJTyN0pCOtn45/jzQhk9
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 29 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 7 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9f3b8a813d7077825f0c17f9cbcff86ca1b883413675badd7adc00d5221dd01.exe"C:\Users\Admin\AppData\Local\Temp\a9f3b8a813d7077825f0c17f9cbcff86ca1b883413675badd7adc00d5221dd01.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\da074206-a55f-4847-ad3f-a2eb4a3ad6d8\setup.exeC:\Users\Admin\AppData\Local\Temp\da074206-a55f-4847-ad3f-a2eb4a3ad6d8\setup.exe2⤵
- Drops startup file
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\wsearch\searchm.dll" -s3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\wsearch\Search.exe"C:\Program Files (x86)\wsearch\Search.exe" us3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\da074206-a55f-4847-ad3f-a2eb4a3ad6d8\setup_s86.exeC:\Users\Admin\AppData\Local\Temp\da074206-a55f-4847-ad3f-a2eb4a3ad6d8\setup_s86.exe /S /R02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b9be714-b8ee-4e33-96d5-b74f376eda6e\setup_s86.exeC:\Users\Admin\AppData\Local\Temp\4b9be714-b8ee-4e33-96d5-b74f376eda6e\setup_s86.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\PROGRA~2\MMSASS~1\MMSASS~1.DLL,EasyFunc4⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exeC:\PROGRA~2\MMSASS~1\MMSASS~1.DLL,EasyFunc4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\4b9be714-b8ee-4e33-96d5-b74f376eda6e\setup_01cncw01.exeC:\Users\Admin\AppData\Local\Temp\4b9be714-b8ee-4e33-96d5-b74f376eda6e\setup_01cncw01.exe /S /R03⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s dtservice.dll /S /R04⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD50b2766051d9fdaab37ed2f5aa5375deb
SHA10fa903c94e2880918bef4a618e0d7cdbb20b0401
SHA2565134d0f86c6f1af64ec6b634711833e0f706066acc668a2e57d9fff493383da9
SHA5123be65597b50e278938a92a771a41a2c8ae3c5de978fafcf8e34ec2267b5dbeff2769869f235ba7eb4a57381972439fa02c7aaae71721b194202aa65f48cf29cf
-
Filesize
109B
MD56e30f8f2fe8d7db530e8a3ee56148f71
SHA1bc1692fa78eba3eea4af73e04124a43aa60f48a0
SHA2560c4bf097293013f20f2d8b79756c049ecd31b78e55079a3055490b7f9c1ae4c8
SHA5125182f43107d5872d9438a13161e0e96d9d0e1df9f9c2ca6e15015e2b9f8b07011440abb69fdc1c7de421436414155f7ecbda2d0b42f35bb7bcc36dff8c54a4d5
-
Filesize
64KB
MD523dc474fa7d3f168893a0636ec39e8b3
SHA11d20d251dde02aaa1b34c8681f7a2f60b5af98cf
SHA256b7063981dc266732e4cc464a07f2eca1e2b0aa5cb8d792199051bd7771a0661a
SHA51275e43e5963b07da4550416593453557a789041f5a662071de59a49f0cffa8fae748b1ab02f464f24a8facdc078923834b0a4ee23309b6c7438a06ba2ffe47097
-
Filesize
128KB
MD538f7505baa41babeb4b674582eed4bd3
SHA1943d339092953b7655e2ab2db78c578b3fcc6ece
SHA256ed17df692787452404530ca05e5a33a215272ff95dfe3fc34162d7dd44fe6dd2
SHA5129e1ea332a101106fa6cd6a730d00affc263e418f41a2b111a4212f363bd3dcc6a716e355ab7a79bc9ea16bc3f96beaad9062edcf3259368dd3669327be3b2a73
-
Filesize
40KB
MD5e087ca7bd81e37c81f825eb6418ab004
SHA1cb97cdf077624ac84c0c091b85f0af5a219217c0
SHA2566c5170a251cc9276c0568ad07aad23524efa8362f2b7a58cc0b0b76c92c11858
SHA512f36b074cdd541394f96d2d8ebee29baa83b5913973d6b742f79e78f869ee87a197e41f3a2639692733e9413466144590b9a5488a97918421b9b63ff9fcd50530
-
Filesize
25B
MD5598e9b90b57c0153e34c30332f044c9a
SHA1775d3e64d21c5f4d1023bd05ffe638eadc7e1474
SHA256c504fc16c030f1a80a770b912395c5dd2966a9b18149ae456096d60ba67e4b96
SHA51248ae053006b3eba2f9bd995feae7f4d71301ab7eabeb4200f24c85722c74c8099ca5dbc8622314dc64b2c6f0905918a00984c91732e2fcfd9fc6ce9817fd2e36
-
Filesize
58B
MD5f97c2db5861806dc880dc006a53bbbf1
SHA11581f94f201ad1eb1a4c41424d16e18de9a857a8
SHA256afca412a4c257c8d4f79f60589703b15cd1b9c8dd603570e597d37b3f0c97b9c
SHA512ffd0d231b8cf0d8e388c2e8a3a0ff620709a4b47cdebef7bd982c02b9001aa98f7ac0675a663f260c6dc4797219bd312469d06fd1b217399293ab5122166b2e2
-
Filesize
47B
MD5f3ded4515c32fa07a64eb37018da0e8b
SHA1ca0edf7d4d034e6230d723cce338d46b79e0ab29
SHA25631d714722d5965915fae49684017098f307b77b83f37a4c9070301628cb49e08
SHA512f7b0b2ec3a4e8207dd71137b2bc844839c06f3aa0f2ea3ee9804750bb8f4c63888908a159373b038668cc4fdac184d8c053df5a726304cb7b50063a220041893
-
Filesize
63B
MD5a3c6f56e44fd905ccddaa02484cf2864
SHA1fff91ff19af16ba4c6e579a4d8e5612b609fed3a
SHA256a7568b4423a2a024ad327016632c76c79a8d2df62119de90b67e8ade236816c9
SHA5121060cbb7603c063fcd931d166382a85981abfbb85a926704c3092116ce55d58490e2754af3be2d5848469f5c2cd6e35728455fb0e9af8da26930a4209a1c5332
-
Filesize
62KB
MD52944145db28891a98dbe7a3bd53277f1
SHA1eacdc784f0e7562f5f47be96c8de5bcfd1c62ecb
SHA256f17995a576e8f03dd82e8b0359c74ae629bff9c8c9850fa19aae9a72a9c040b4
SHA51295224c48a7a9210824011a93eaa4208ef8fd1ad0d702c5f49819d2e753f5105d92f492a9895e5418b6c38d55a219c7ef0b990ba17116b7c1933e8c42b1237a95
-
Filesize
65KB
MD59cba20149aa9b7caa99414655fc3fd26
SHA13f1ffdf865984bdef6c513e4ce280dbac893037c
SHA2567cf861a4063807fecda85d37ca1f9effab6efa4ab2a5ec60ed89f407c72c5007
SHA512e53e2895663a0c0b52c9e3c4a66cfd9ebeb28f9552ae2adcde1b6142866312ff5b8a9cad226f9ca9da39af74a8aa7e11b69d207ce29a5ee4a9765999616b0159
-
Filesize
240KB
MD57f9fbada8a80cee46962cb8f191db6f0
SHA10ae14944174981e89a08001a214b6cf5a1f1da59
SHA256488d4bfad05e370516e92f6b824a8c751ea00d66a32ca0ebc5b05aca5e4d08f9
SHA5126ba518c9a02835b8eb5621e7caaca6d5a805bc1e0c093ab41396c0fe3e4a286d136d7b83704b60591186fa2a9cea37462d9cafab20c3a9a11f9975b542fe0499
-
Filesize
180KB
MD5c132031b0cbdd0fd485efd0bbcd78c3e
SHA1e7295c3c9a253bee169c8c0a997876895d7a9e9b
SHA256c1ef5b4cc978d33ff628b31dab1be761db750967ca5f08a4b851b05ff7ec7f81
SHA5128ef62e686aa9d501496b548b09d310fb14c2d8fa44ee458a42e6462d36142372550dd257d50b27f81d0033e6de5bb0baa0b09cddb0168735af0f99303ef1251d
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
140KB
-
Filesize
140KB