Overview
overview
10Static
static
7872846234.zip
windows7-x64
17872846234.zip
windows10-2004-x64
1DBUG.ps1
windows7-x64
1DBUG.ps1
windows10-2004-x64
1WinSupport...re.dll
windows7-x64
1WinSupport...re.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
3WinSupport...EK.dll
windows7-x64
1WinSupport...EK.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
1WinSupport...32.exe
windows7-x64
10WinSupport...32.exe
windows10-2004-x64
10WinSupport...00.dll
windows7-x64
3WinSupport...00.dll
windows10-2004-x64
3WinSupport...pi.dll
windows7-x64
1WinSupport...pi.dll
windows10-2004-x64
1WinSupport...ub.exe
windows7-x64
1WinSupport...ub.exe
windows10-2004-x64
1LOCALES/MSAMRNBD.dll
windows7-x64
1LOCALES/MSAMRNBD.dll
windows10-2004-x64
1LOCALES/MSAMRNBE.dll
windows7-x64
1LOCALES/MSAMRNBE.dll
windows10-2004-x64
1LOCALES/MSAUDDEC.dll
windows7-x64
1LOCALES/MSAUDDEC.dll
windows10-2004-x64
1LOCALES/MSAUDITE.dll
windows7-x64
1LOCALES/MSAUDITE.dll
windows10-2004-x64
1LOCALES/PROTONVP.exe
windows7-x64
7LOCALES/PROTONVP.exe
windows10-2004-x64
7Analysis
-
max time kernel
64s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-08-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
7872846234.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7872846234.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
DBUG.ps1
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
DBUG.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
WinSupportSn/AudioCapture.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
WinSupportSn/AudioCapture.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
WinSupportSn/HTCTL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
WinSupportSn/HTCTL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
WinSupportSn/PCICHEK.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
WinSupportSn/PCICHEK.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
WinSupportSn/PCICL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
WinSupportSn/PCICL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
WinSupportSn/TCCTL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
WinSupportSn/TCCTL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
WinSupportSn/client32.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
WinSupportSn/client32.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
WinSupportSn/msvcr100.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
WinSupportSn/msvcr100.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
WinSupportSn/pcicapi.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
WinSupportSn/pcicapi.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
WinSupportSn/remcmdstub.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
WinSupportSn/remcmdstub.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
LOCALES/MSAMRNBD.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
LOCALES/MSAMRNBD.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
LOCALES/MSAMRNBE.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
LOCALES/MSAMRNBE.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
LOCALES/MSAUDDEC.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
LOCALES/MSAUDDEC.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
LOCALES/MSAUDITE.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
LOCALES/MSAUDITE.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
LOCALES/PROTONVP.exe
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
LOCALES/PROTONVP.exe
Resource
win10v2004-20220812-en
General
-
Target
LOCALES/PROTONVP.exe
-
Size
26.9MB
-
MD5
e751f97a3d99007fd4f3bade78df78a1
-
SHA1
ec8be5c865e959b8675667a689851c2683e5c8d0
-
SHA256
b6db90130e99b34b6b28cd48c244b5c897baaa6f5cb200f83feb74d32614a3e3
-
SHA512
209ddb2fcd2ac2109ac517cf2608580286c7aa07ba876611caace0a057608112299468b7c1ff7b29ddbcfeabb7f037fed2cb64b622fe4fe925ef512d9725a5bd
-
SSDEEP
393216:sHx59nxhJiSeLlkWDwCv47V14sgoBSgTjdEyEMFwqLtZ/vzMkxaL7z+Nlp/:Ut3peL6OwCv4cod3zEM6qLtFvW+1/
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
Processes:
PROTONVP.exeMsiExec.exepid process 1160 PROTONVP.exe 1160 PROTONVP.exe 1792 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exePROTONVP.exedescription ioc process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\F: PROTONVP.exe File opened (read-only) \??\M: PROTONVP.exe File opened (read-only) \??\Z: PROTONVP.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: PROTONVP.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: PROTONVP.exe File opened (read-only) \??\S: PROTONVP.exe File opened (read-only) \??\T: PROTONVP.exe File opened (read-only) \??\X: PROTONVP.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: PROTONVP.exe File opened (read-only) \??\J: PROTONVP.exe File opened (read-only) \??\N: PROTONVP.exe File opened (read-only) \??\Q: PROTONVP.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: PROTONVP.exe File opened (read-only) \??\U: PROTONVP.exe File opened (read-only) \??\W: PROTONVP.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: PROTONVP.exe File opened (read-only) \??\V: PROTONVP.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: PROTONVP.exe File opened (read-only) \??\E: PROTONVP.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: PROTONVP.exe File opened (read-only) \??\H: PROTONVP.exe File opened (read-only) \??\K: PROTONVP.exe File opened (read-only) \??\R: PROTONVP.exe File opened (read-only) \??\Y: PROTONVP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exePROTONVP.exedescription pid process Token: SeRestorePrivilege 1800 msiexec.exe Token: SeTakeOwnershipPrivilege 1800 msiexec.exe Token: SeSecurityPrivilege 1800 msiexec.exe Token: SeCreateTokenPrivilege 1160 PROTONVP.exe Token: SeAssignPrimaryTokenPrivilege 1160 PROTONVP.exe Token: SeLockMemoryPrivilege 1160 PROTONVP.exe Token: SeIncreaseQuotaPrivilege 1160 PROTONVP.exe Token: SeMachineAccountPrivilege 1160 PROTONVP.exe Token: SeTcbPrivilege 1160 PROTONVP.exe Token: SeSecurityPrivilege 1160 PROTONVP.exe Token: SeTakeOwnershipPrivilege 1160 PROTONVP.exe Token: SeLoadDriverPrivilege 1160 PROTONVP.exe Token: SeSystemProfilePrivilege 1160 PROTONVP.exe Token: SeSystemtimePrivilege 1160 PROTONVP.exe Token: SeProfSingleProcessPrivilege 1160 PROTONVP.exe Token: SeIncBasePriorityPrivilege 1160 PROTONVP.exe Token: SeCreatePagefilePrivilege 1160 PROTONVP.exe Token: SeCreatePermanentPrivilege 1160 PROTONVP.exe Token: SeBackupPrivilege 1160 PROTONVP.exe Token: SeRestorePrivilege 1160 PROTONVP.exe Token: SeShutdownPrivilege 1160 PROTONVP.exe Token: SeDebugPrivilege 1160 PROTONVP.exe Token: SeAuditPrivilege 1160 PROTONVP.exe Token: SeSystemEnvironmentPrivilege 1160 PROTONVP.exe Token: SeChangeNotifyPrivilege 1160 PROTONVP.exe Token: SeRemoteShutdownPrivilege 1160 PROTONVP.exe Token: SeUndockPrivilege 1160 PROTONVP.exe Token: SeSyncAgentPrivilege 1160 PROTONVP.exe Token: SeEnableDelegationPrivilege 1160 PROTONVP.exe Token: SeManageVolumePrivilege 1160 PROTONVP.exe Token: SeImpersonatePrivilege 1160 PROTONVP.exe Token: SeCreateGlobalPrivilege 1160 PROTONVP.exe Token: SeCreateTokenPrivilege 1160 PROTONVP.exe Token: SeAssignPrimaryTokenPrivilege 1160 PROTONVP.exe Token: SeLockMemoryPrivilege 1160 PROTONVP.exe Token: SeIncreaseQuotaPrivilege 1160 PROTONVP.exe Token: SeMachineAccountPrivilege 1160 PROTONVP.exe Token: SeTcbPrivilege 1160 PROTONVP.exe Token: SeSecurityPrivilege 1160 PROTONVP.exe Token: SeTakeOwnershipPrivilege 1160 PROTONVP.exe Token: SeLoadDriverPrivilege 1160 PROTONVP.exe Token: SeSystemProfilePrivilege 1160 PROTONVP.exe Token: SeSystemtimePrivilege 1160 PROTONVP.exe Token: SeProfSingleProcessPrivilege 1160 PROTONVP.exe Token: SeIncBasePriorityPrivilege 1160 PROTONVP.exe Token: SeCreatePagefilePrivilege 1160 PROTONVP.exe Token: SeCreatePermanentPrivilege 1160 PROTONVP.exe Token: SeBackupPrivilege 1160 PROTONVP.exe Token: SeRestorePrivilege 1160 PROTONVP.exe Token: SeShutdownPrivilege 1160 PROTONVP.exe Token: SeDebugPrivilege 1160 PROTONVP.exe Token: SeAuditPrivilege 1160 PROTONVP.exe Token: SeSystemEnvironmentPrivilege 1160 PROTONVP.exe Token: SeChangeNotifyPrivilege 1160 PROTONVP.exe Token: SeRemoteShutdownPrivilege 1160 PROTONVP.exe Token: SeUndockPrivilege 1160 PROTONVP.exe Token: SeSyncAgentPrivilege 1160 PROTONVP.exe Token: SeEnableDelegationPrivilege 1160 PROTONVP.exe Token: SeManageVolumePrivilege 1160 PROTONVP.exe Token: SeImpersonatePrivilege 1160 PROTONVP.exe Token: SeCreateGlobalPrivilege 1160 PROTONVP.exe Token: SeCreateTokenPrivilege 1160 PROTONVP.exe Token: SeAssignPrimaryTokenPrivilege 1160 PROTONVP.exe Token: SeLockMemoryPrivilege 1160 PROTONVP.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
PROTONVP.exepid process 1160 PROTONVP.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe PID 1800 wrote to memory of 1792 1800 msiexec.exe MsiExec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LOCALES\PROTONVP.exe"C:\Users\Admin\AppData\Local\Temp\LOCALES\PROTONVP.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1BE9FC6ED0E82700AA85DFD9BA46A456 C2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSI217C.tmpFilesize
495KB
MD5cfab78ac0d042a1d8ad7085a94328ef6
SHA1b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA25617b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
SHA512647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
-
\Users\Admin\AppData\Local\Temp\MSI217C.tmpFilesize
495KB
MD5cfab78ac0d042a1d8ad7085a94328ef6
SHA1b3070cc847ba2739450dc9bd05040df83e7d85d2
SHA25617b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168
SHA512647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438
-
\Users\Admin\AppData\Local\Temp\{78E8B570-4551-416B-8F87-6917E1EBBAF9}\decoder.dllFilesize
206KB
MD5899944fb96ccc34cfbd2ccb9134367c5
SHA17c46aa3f84ba5da95ceff39cd49185672f963538
SHA256780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
SHA5122c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
-
\Users\Admin\AppData\Local\Temp\{78E8B570-4551-416B-8F87-6917E1EBBAF9}\decoder.dllFilesize
206KB
MD5899944fb96ccc34cfbd2ccb9134367c5
SHA17c46aa3f84ba5da95ceff39cd49185672f963538
SHA256780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259
SHA5122c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0
-
memory/1160-54-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1160-55-0x0000000073E91000-0x0000000073E93000-memory.dmpFilesize
8KB
-
memory/1792-59-0x0000000000000000-mapping.dmp
-
memory/1800-58-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmpFilesize
8KB