Analysis
-
max time kernel
41s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
22-08-2022 09:21
General
-
Target
LOCALES/PROTONVP.exe
-
Size
26.9MB
-
MD5
e751f97a3d99007fd4f3bade78df78a1
-
SHA1
ec8be5c865e959b8675667a689851c2683e5c8d0
-
SHA256
b6db90130e99b34b6b28cd48c244b5c897baaa6f5cb200f83feb74d32614a3e3
-
SHA512
209ddb2fcd2ac2109ac517cf2608580286c7aa07ba876611caace0a057608112299468b7c1ff7b29ddbcfeabb7f037fed2cb64b622fe4fe925ef512d9725a5bd
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LOCALES\PROTONVP.exe"C:\Users\Admin\AppData\Local\Temp\LOCALES\PROTONVP.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 03DB6E892757343C5CC25F81CEA75424 C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI5A47.tmpFilesize
495KB
MD5cfab78ac0d042a1d8ad7085a94328ef6
SHA1b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA25617b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
SHA512647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
-
\Users\Admin\AppData\Local\Temp\MSI5A47.tmpFilesize
495KB
MD5cfab78ac0d042a1d8ad7085a94328ef6
SHA1b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA25617b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
SHA512647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
-
\Users\Admin\AppData\Local\Temp\{78E8B570-4551-416B-8F87-6917E1EBBAF9}\decoder.dllFilesize
206KB
MD5899944fb96ccc34cfbd2ccb9134367c5
SHA17c46aa3f84ba5da95ceff39cd49185672f963538
SHA256780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
SHA5122c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
-
\Users\Admin\AppData\Local\Temp\{78E8B570-4551-416B-8F87-6917E1EBBAF9}\decoder.dllFilesize
206KB
MD5899944fb96ccc34cfbd2ccb9134367c5
SHA17c46aa3f84ba5da95ceff39cd49185672f963538
SHA256780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
SHA5122c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
-
memory/1716-59-0x0000000000000000-mapping.dmp
-
memory/2020-54-0x0000000076801000-0x0000000076803000-memory.dmpFilesize
8KB
-
memory/2020-55-0x00000000745A1000-0x00000000745A3000-memory.dmpFilesize
8KB
-
memory/2040-58-0x000007FEFC3D1000-0x000007FEFC3D3000-memory.dmpFilesize
8KB