c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852

Analysis

max time kernel
69s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe
Size

427KB
MD5

68a7bc0374dc3ff3e8da5434956f8950
SHA1

6c2131c1502bb118e8386e51d8fa9d859a510bd4
SHA256

c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852
SHA512

8ef4e0260e8a8111acdf0253e282459ce27706d8a25f63c7d6fed6ce7dd752158749d84eb1a651c7ffa28192a10c62d938533aa9fa55cfabd2141042667cc5c7
SSDEEP

12288:67wuMo+h5QhrwsWpvQIqNo56dSc+3YWq9+ne7Afz3rcqJCPzRb:67soA5Q1VWpvXqi56Ac+3W+nTfz7FMPt

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0003000000000727-134.dat	acprotect
behavioral2/files/0x0003000000000727-133.dat	acprotect
behavioral2/files/0x000500000000072d-140.dat	acprotect
behavioral2/files/0x000500000000072d-139.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1008	Au_.exe

Loads dropped DLL 7 IoCs

pid	Process
1804	c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe
1804	c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe
1008	Au_.exe
1008	Au_.exe
1008	Au_.exe
1008	Au_.exe
1008	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1008	Au_.exe
1008	Au_.exe
1008	Au_.exe
1008	Au_.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1804	c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe
1008	Au_.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1008	1804	c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe	84
PID 1804 wrote to memory of 1008	1804	c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe	84
PID 1804 wrote to memory of 1008	1804	c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe	84

C:\Users\Admin\AppData\Local\Temp\c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe
"C:\Users\Admin\AppData\Local\Temp\c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mxiEE7B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxiEE7B.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaEF59.tmp\InstallOptions.dll

Filesize
15KB

MD5
f6d325fa6aa99b5f796fec6c34faf25e

SHA1
a5fe9e0bf17bbbcc268ed13bbfd9d8b7f711566a

SHA256
20fa6fce5d11d4cf6e8b61ee91f52d66d2bf23a8b1fe961c95afd15199999b33

SHA512
474a4e215e196e4d4612ed94688fd19468b4ff8586e5addc4e32cb51185ab7c7586f9fe87207cd46a06144ddaa35794e81820fe06fc66b1c6981ddbac7485ff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaEF59.tmp\InstallOptions.dll

Filesize
15KB

MD5
f6d325fa6aa99b5f796fec6c34faf25e

SHA1
a5fe9e0bf17bbbcc268ed13bbfd9d8b7f711566a

SHA256
20fa6fce5d11d4cf6e8b61ee91f52d66d2bf23a8b1fe961c95afd15199999b33

SHA512
474a4e215e196e4d4612ed94688fd19468b4ff8586e5addc4e32cb51185ab7c7586f9fe87207cd46a06144ddaa35794e81820fe06fc66b1c6981ddbac7485ff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaEF59.tmp\ProcDll.dll

Filesize
395KB

MD5
e2ac47e74f3a85572245aa36b94700ad

SHA1
adb0e0d7b3d94cdc094170dae005f4169e7f7627

SHA256
4100e4e09359634f5a1aacdc72237846c998ec21fc5f1133c8f60f3a18859f29

SHA512
0b9c7f711f41d931d6db7d90ff5effbfbfb9943750521fee6a39ebbb357c6b10499c9e66c27636f8f0fd9a4239c5ea25009810538462ea9dc1e648add7de663a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wxiEAE2.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wxiEAE2.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
427KB

MD5
68a7bc0374dc3ff3e8da5434956f8950

SHA1
6c2131c1502bb118e8386e51d8fa9d859a510bd4

SHA256
c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852

SHA512
8ef4e0260e8a8111acdf0253e282459ce27706d8a25f63c7d6fed6ce7dd752158749d84eb1a651c7ffa28192a10c62d938533aa9fa55cfabd2141042667cc5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
427KB

MD5
68a7bc0374dc3ff3e8da5434956f8950

SHA1
6c2131c1502bb118e8386e51d8fa9d859a510bd4

SHA256
c1250efcdb2630594039ada3b95837b15c3b96236ac36c5be235d7a193a20852

SHA512
8ef4e0260e8a8111acdf0253e282459ce27706d8a25f63c7d6fed6ce7dd752158749d84eb1a651c7ffa28192a10c62d938533aa9fa55cfabd2141042667cc5c7

Download Submit
memory/1008-142-0x0000000002120000-0x0000000002193000-memory.dmp

Filesize
460KB

Download
memory/1008-143-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1008-147-0x0000000003491000-0x0000000003493000-memory.dmp

Filesize
8KB

Download
memory/1008-148-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1804-141-0x0000000002290000-0x0000000002303000-memory.dmp

Filesize
460KB

Download
memory/1804-138-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1804-132-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download