Analysis
-
max time kernel
38s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 16:55
Behavioral task
behavioral1
Sample
d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe
-
Size
22KB
-
MD5
6020c8cc875f5c834ad17378986eaf71
-
SHA1
c123bb0373f27af46ea21f8c3247dab06dd193b5
-
SHA256
d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd
-
SHA512
68fd64c1700bf05de8117bd1b866a0d5bb388e660d0f0cf66a06144221776c887f2d2c6fd5c51af9c8875973b709d972b8a92a8537fddfa84d24d23d95cbd634
-
SSDEEP
384:gAGRXZQjTPkfmHORjFO1ILwNOh84gWeEbOJJs5vNY43GLbzXZpiBeVlcGPdX2:YtyTP7HOirQMWenJJZ4Y/ZVlcgdG
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b0000000122d2-55.dat acprotect -
resource yara_rule behavioral1/files/0x000b0000000122d2-55.dat upx behavioral1/memory/1248-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1248-57-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1248-59-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1988 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\fOnts\MhaUKGazkr3fZZKp.Ttf d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe File opened for modification C:\Windows\fonts\fyrwJf5Qfhh.fon d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15882A2F-A06D-486E-8958-E84C86CBF273}\InprocServer32\ThreadingModel = "Apartment" d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{15882A2F-A06D-486E-8958-E84C86CBF273}\InprocServer32 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15882A2F-A06D-486E-8958-E84C86CBF273} d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15882A2F-A06D-486E-8958-E84C86CBF273}\InprocServer32 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15882A2F-A06D-486E-8958-E84C86CBF273}\InprocServer32\ = "C:\\Windows\\fonts\\fyrwJf5Qfhh.fon" d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe Token: SeDebugPrivilege 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1988 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 26 PID 1248 wrote to memory of 1988 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 26 PID 1248 wrote to memory of 1988 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 26 PID 1248 wrote to memory of 1988 1248 d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe"C:\Users\Admin\AppData\Local\Temp\d7c9364bdd8baa30807b4e8bcc7470daeb311a628a2e3455712ef7b54b6a64bd.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D7C936~1.EXE >> NUL2⤵
- Deletes itself
PID:1988
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD57b1a13dbccfe515a76225ce1f20580cc
SHA16232885843bc59194b575a4d6d734d7f4b84a5d0
SHA25654ef34050e7ee235add64a4183ec9a6873671681755564156871f9fbfa916ee8
SHA512f5c219c4940307f784131abdb563684c3ac120789a634d8cf9fc989609e44f8606e7e6408c7477f7d05ced0dff3e06bef913cb90e6dd544167aaa896fc1b5850