78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe
Size

6.0MB
MD5

0d53b8fbcb984c7eeea01c0e0c14d99b
SHA1

5454652047707ccc4b7b300250585957b78be884
SHA256

78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4
SHA512

e4d1755519402bd2bc10c83e09cd3b6afdb4b50c9218c690e2b3bd1ac2e133e6a51ec46f40dc8b3cc7afe4f8d7e970d827b9b6fa5887bb4d90ce2236619e48fe
SSDEEP

98304:zhVOYRYybVGu3sdy18XBkhP6uJoyew1szuq2FL3PAkbEowy5SdwTJYySIdR:zhxRPAu3sdLXBlQoyPap2FL3Ieeygg

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll acprotect
Loads dropped DLL 2 IoCs

Processes:

78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe

pid process

1180 78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe
1180 78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1180-0-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral2/memory/1180-2-0x0000000010000000-0x0000000010018000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll	upx
behavioral2/memory/1180-14-0x00000000073D0000-0x000000000746F000-memory.dmp	upx
behavioral2/memory/1180-13-0x00000000073D0000-0x000000000746F000-memory.dmp	upx
behavioral2/memory/1180-42-0x00000000073D0000-0x000000000746F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe

pid	process
1180	78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe
1180	78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe
1180	78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe

description	pid	process	target process
PID 1180 wrote to memory of 3552	1180	78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe	cacls.exe
PID 1180 wrote to memory of 3552	1180	78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe	cacls.exe
PID 1180 wrote to memory of 3552	1180	78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe
"C:\Users\Admin\AppData\Local\Temp\78e55a37ae63b4aa67c48a2048a1ac0b9b1365746d4a884eb6fc2c4da2bdf8c4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\cacls.exe
cacls "" /e /p everyone:n
2⤵
PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7-zip32_2.dll
Filesize
233KB

MD5
ea3df059beae86a3e186b2b179755e77

SHA1
babdcd6b5082c02fa2f5ebc2020f2cb3bbd77e8d

SHA256
1ab68a0c296281437fe638c8535309c6241ded4852608d940f5efcb8cc2d91a6

SHA512
1406d8083cfbd26e18aba74f6b45a09137bb3960f7afce5c5d0d790b0edb7277b7b885ed2ded9def12b667bcb37cbfb335884b2d7b8f08565743b674d1f053bb

Download Submit
memory/1180-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1180-2-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1180-3-0x0000000076379000-0x000000007637A000-memory.dmp

Filesize
4KB

Download
memory/1180-4-0x0000000076360000-0x0000000076450000-memory.dmp

Filesize
960KB

Download
memory/1180-14-0x00000000073D0000-0x000000000746F000-memory.dmp

Filesize
636KB

Download
memory/1180-13-0x00000000073D0000-0x000000000746F000-memory.dmp

Filesize
636KB

Download
memory/1180-42-0x00000000073D0000-0x000000000746F000-memory.dmp

Filesize
636KB

Download
memory/1180-43-0x0000000076360000-0x0000000076450000-memory.dmp

Filesize
960KB

Download