Analysis
-
max time kernel
76s -
max time network
75s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
Resource
win7-20220715-en
General
-
Target
574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
-
Size
656KB
-
MD5
69306b2a40b36f4c4a19d323bbafa285
-
SHA1
af4ba9bd7e6ebe90c2e7c65e5939055b4408c151
-
SHA256
574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6
-
SHA512
dedec3db2d6a4ee35eb1fbd3c50fd23467ee74501681b2c5380a52bc9ac3ce98cba0316b577ae514ba61eaff90ea7df5f8ce30c9a315af4019f3c21a9b3e16fa
Malware Config
Signatures
-
suricata: ET MALWARE Win32/DownloadAdmin Activity
suricata: ET MALWARE Win32/DownloadAdmin Activity
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsy7A22.tmp\versioninfo.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsy7A22.tmp\versioninfo.dll upx behavioral1/memory/1336-78-0x0000000000520000-0x000000000052C000-memory.dmp upx behavioral1/memory/1336-83-0x0000000000520000-0x000000000052C000-memory.dmp upx -
Loads dropped DLL 19 IoCs
Processes:
574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exepid process 1164 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 2036 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 1336 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe -
Processes:
574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exedescription pid process target process PID 1164 wrote to memory of 2036 1164 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 1164 wrote to memory of 2036 1164 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 1164 wrote to memory of 2036 1164 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 1164 wrote to memory of 2036 1164 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 2036 wrote to memory of 1336 2036 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 2036 wrote to memory of 1336 2036 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 2036 wrote to memory of 1336 2036 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe PID 2036 wrote to memory of 1336 2036 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe 574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"C:\Users\Admin\AppData\Local\Temp\574d9ada03823e97f8b7545428d5dabbffc2ae5e54cc7d299349d3a3a74103a6.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsd781F.tmp\LuaBridge.dllFilesize
62KB
MD54e08fe995ab74ba4d145ddb77ea095fc
SHA1e4bb337e40069c097e7abd566b7427b11fb124ee
SHA256ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17
SHA512b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f
-
\Users\Admin\AppData\Local\Temp\nst7967.tmp\LuaBridge.dllFilesize
62KB
MD54e08fe995ab74ba4d145ddb77ea095fc
SHA1e4bb337e40069c097e7abd566b7427b11fb124ee
SHA256ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17
SHA512b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\026e996a3a5897970b058ffb093a163a1d763649.dllFilesize
11KB
MD50a29e1b270ccea61aba7d7cdd10e0388
SHA176bf03361bcaef475ffb864bc1903c9bcaac7b44
SHA25667328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb
SHA512d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\026e996a3a5897970b058ffb093a163a1d763649.dllFilesize
11KB
MD50a29e1b270ccea61aba7d7cdd10e0388
SHA176bf03361bcaef475ffb864bc1903c9bcaac7b44
SHA25667328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb
SHA512d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\026e996a3a5897970b058ffb093a163a1d763649.dllFilesize
11KB
MD50a29e1b270ccea61aba7d7cdd10e0388
SHA176bf03361bcaef475ffb864bc1903c9bcaac7b44
SHA25667328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb
SHA512d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\1370ebd534807c69ad0db6461cbf3f3fd03c434f.dllFilesize
193KB
MD5e390287499549de31da007f7f0ae4d10
SHA1a8c6caebb151d60ea56f4c96a7194c0e5f076692
SHA256b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b
SHA5126c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\1370ebd534807c69ad0db6461cbf3f3fd03c434f.dllFilesize
193KB
MD5e390287499549de31da007f7f0ae4d10
SHA1a8c6caebb151d60ea56f4c96a7194c0e5f076692
SHA256b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b
SHA5126c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\1370ebd534807c69ad0db6461cbf3f3fd03c434f.dllFilesize
193KB
MD5e390287499549de31da007f7f0ae4d10
SHA1a8c6caebb151d60ea56f4c96a7194c0e5f076692
SHA256b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b
SHA5126c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dllFilesize
80KB
MD54bf7db111acfa7c28ad36606107b3322
SHA16f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA256bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
SHA5120a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\FloatingProgress.dllFilesize
25KB
MD50f26c6d34d3841e93145dd00d0175651
SHA157b068569d0eb2336503beed87589629ab2a6f1f
SHA2560cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
SHA51272785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\LuaBridge.dllFilesize
62KB
MD54e08fe995ab74ba4d145ddb77ea095fc
SHA1e4bb337e40069c097e7abd566b7427b11fb124ee
SHA256ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17
SHA512b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\LuaXml_lib.dllFilesize
11KB
MD57292b642bd958aeb7fd7cfd19e45b068
SHA119a800620d041634abae5b5d096cb0e87ce4c188
SHA25690f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\System.dllFilesize
10KB
MD57e3c808299aa2c405dffa864471ddb7f
SHA1b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA25691c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
SHA512599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\UACInfo.dllFilesize
4KB
MD5d02a497be5f89c44827f142c4662f591
SHA138f83ccbac11de069df0e1cd79a6fdf7f006516c
SHA2566d29dfd24695535b5973d8261d93373603ceaae03ab97662fe1b3dcc47d18226
SHA51281c87f9d56a8ab7703a4effd3ba7b982b6765ecbdc0dbb1c595f549c4310a5db57dcdc38929eafe56983ea8cefc0b572c3faf82a4b62eb7c564b05550215f1c1
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\f40368059830399ce8189100003d317f2739d087.dllFilesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\f40368059830399ce8189100003d317f2739d087.dllFilesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\f40368059830399ce8189100003d317f2739d087.dllFilesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\lua51.dllFilesize
255KB
MD5fceee0026aafd237afdb4aea4ecd3557
SHA13e10da57143599eae915a688178abada78b8d82b
SHA25685db1e17c0fad08d9732405e781cda1e1613ace31c540a6e559cd8777df2c62c
SHA5129c974918c8afec8d8a58fc1239f269544b9dfe867459bb61901462f56f71a3dd574d3b2263dd14b99ff8a23c8096c408be3620785fd4476b975a43b999f559f2
-
\Users\Admin\AppData\Local\Temp\nsy7A22.tmp\versioninfo.dllFilesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
-
memory/1164-54-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1336-70-0x00000000004C0000-0x00000000004CE000-memory.dmpFilesize
56KB
-
memory/1336-76-0x0000000074CD0000-0x0000000074D2E000-memory.dmpFilesize
376KB
-
memory/1336-66-0x0000000000490000-0x00000000004A6000-memory.dmpFilesize
88KB
-
memory/1336-78-0x0000000000520000-0x000000000052C000-memory.dmpFilesize
48KB
-
memory/1336-59-0x0000000000000000-mapping.dmp
-
memory/1336-82-0x0000000074CD0000-0x0000000074D2E000-memory.dmpFilesize
376KB
-
memory/1336-83-0x0000000000520000-0x000000000052C000-memory.dmpFilesize
48KB
-
memory/2036-56-0x0000000000000000-mapping.dmp