Analysis
-
max time kernel
43s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 04:27
Behavioral task
behavioral1
Sample
cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe
-
Size
47KB
-
MD5
3111675bbe13e4b3aab627e04f9fa5eb
-
SHA1
9c3da27ebf1e8d1112ff463d308223b3af658b49
-
SHA256
cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc
-
SHA512
30978cbf9ecded72ceb49a070acd2eeb855be1eac4577dd8692e725d74b416d27f67296f27bcf50d96ba10d6d6c275eb9cf0eb0c943f52d37f0394b3a968f1dd
-
SSDEEP
384:c5m4HaxadRPXA030iMeiYk+TKDjq8xLcm7Mi8++f2wPpR+PoMBSZ9qSsC1oE0ED:c446xadRvhkiMhYpWq8xA0+SBSc6aE
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b000000012315-55.dat acprotect -
resource yara_rule behavioral1/files/0x000b000000012315-55.dat upx behavioral1/memory/948-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/948-57-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral1/memory/948-59-0x0000000010000000-0x0000000010014000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 608 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\vC6ykXbjUGCVeCJa.ico cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe File opened for modification C:\Windows\Downloaded Program Files\WUstNjhyfQfpv8PQbC.cur cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{526EB425-7F56-4773-8D70-B8E45AA8E2B6}\InprocServer32 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{526EB425-7F56-4773-8D70-B8E45AA8E2B6} cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{526EB425-7F56-4773-8D70-B8E45AA8E2B6}\InprocServer32 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{526EB425-7F56-4773-8D70-B8E45AA8E2B6}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\WUstNjhyfQfpv8PQbC.cur" cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{526EB425-7F56-4773-8D70-B8E45AA8E2B6}\InprocServer32\ThreadingModel = "Apartment" cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe Token: SeDebugPrivilege 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 948 wrote to memory of 608 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe 28 PID 948 wrote to memory of 608 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe 28 PID 948 wrote to memory of 608 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe 28 PID 948 wrote to memory of 608 948 cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe"C:\Users\Admin\AppData\Local\Temp\cb4f3e3973c2f700d3ce133d250a38f9bf17a3a51215a2ae4b83a96666ab07fc.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CB4F3E~1.EXE >> NUL2⤵
- Deletes itself
PID:608
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5939c1ba010b6e784a542d90551e36de9
SHA1a666986b1d2ca41fef41f68f8305eb38b889a821
SHA256dafc59fb3ba84aed566e3d637fcd3d5ca226ee3ede3dd511e506195323ecc5d6
SHA51224d1da556b3e217fedf886d59b3577d2a509ee1a28fb5941ec1e623d683f0212a4446ccedf3e16e4379a0f55430a6ba1e4fdb5236f98ac5741f1d1c4e9026ffc