Analysis
-
max time kernel
62s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
04-12-2021 17:32
Static task
static1
Behavioral task
behavioral1
Sample
ThinApp.2111.Portable\ThinAppPortable.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
ThinApp.2111.Portable\ThinAppPortable.exe
Resource
win10-en-20211014
General
-
Target
ThinApp.2111.Portable\ThinAppPortable.exe
-
Size
176KB
-
MD5
67cbc57da0cf46e381b8453054ce1ea5
-
SHA1
70a92b8b2ee74d4e1b07e9ac3bfaee602ec2bfe0
-
SHA256
7de018a017b510c7cb4840489b095e351d6458e7bc3d6c0a79b624db33d90aa6
-
SHA512
3b57e39cbdb28ba048048643401fb8c488dae9b295534d95c1150d1d1ba56b3da04d576522789a73939fc7a811a2ab6c2dc69a44c578b9e4c1bdd6bcf3bc5148
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsm1441.tmp\UAC.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsm1441.tmp\UAC.dll upx -
Loads dropped DLL 2 IoCs
Processes:
ThinAppPortable.exepid process 3212 ThinAppPortable.exe 3212 ThinAppPortable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsm1441.tmp\System.dllMD5
bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
\Users\Admin\AppData\Local\Temp\nsm1441.tmp\UAC.dllMD5
9b54a7f7ab2b340ab2e22e0eee5860a0
SHA18757037b59fcb8e46a0c442e274618a9c13a49ae
SHA25634c68143733dac84ab5e7b7a49e95b9bb1a061c4113d2ddab551f42c4253b28e
SHA51223412e52e767347db06a5b3aa4c9d2ffb5f1a8770e197a51dfd307eda94ec267e5b72297fd3de589bb81f9b0aaa975cf0e3e4bc5b2248c5681ed78ea63394067