75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439

General

Target

75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
Size

82KB
MD5

7b7c2fc6ba3522590124f1f5d6d40990
SHA1

98ea7b143ee5071b02730837d9ab0578d1182f68
SHA256

75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439
SHA512

8cafbe28acb4570bc4b39fc789bbe3c4b1beb131d676969f5aa9c56d8369cfd732dbf2f8250a73b293b6caaf85aa3f17b9458a72835ebf7a5a8ca52ef0a0ab9c
SSDEEP

768:9SFtXQnGjTfbXccQdavRRzEcxZRMy+MZLvVWEwf0lBWQkJPw/:EsU3scQyvzPHcST36JPw

Score

9^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022e32-135.dat	acprotect
behavioral2/files/0x0007000000022e32-137.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3936	myInsDll.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/64-132-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/files/0x0007000000022e32-135.dat	upx
behavioral2/files/0x0007000000022e32-137.dat	upx
behavioral2/memory/64-138-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/3936-141-0x0000000010000000-0x0000000010108000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	myInsDll.exe

Loads dropped DLL 2 IoCs

pid	Process
3936	myInsDll.exe
3936	myInsDll.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcDisable = "4294967197"	myInsDll.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Unamsmqnws.dat	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
File created	C:\Windows\SysWOW64\dnfwg.dll	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
File created	C:\Windows\SysWOW64\myInsDll.exe	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
File opened for modification	C:\Windows\SysWOW64\myInsDll.exe	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
File created	C:\Windows\SysWOW64\sfc32.dll	myInsDll.exe
File opened for modification	C:\Windows\SysWOW64\sfc32.dll	myInsDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	3936	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 3936	64	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe	83
PID 64 wrote to memory of 3936	64	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe	83
PID 64 wrote to memory of 3936	64	75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe	83
PID 3936 wrote to memory of 1236	3936	myInsDll.exe	84
PID 3936 wrote to memory of 1236	3936	myInsDll.exe	84
PID 3936 wrote to memory of 1236	3936	myInsDll.exe	84

C:\Users\Admin\AppData\Local\Temp\75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
"C:\Users\Admin\AppData\Local\Temp\75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\myInsDll.exe
  "C:\Windows\system32\myInsDll.exe" dnfwg.dll,abcdefghjk C:\Users\Admin\AppData\Local\Temp\75ba49bbb6ab9358a188e48d355389003494ca461f9550127c40afc8c8460439.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\sfc.exe
    "C:\Windows\system32\sfc.exe" /REVERT
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1104
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3936 -ip 3936
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dnfwg.dll

Filesize
30KB

MD5
d45ac07f17b08069cf0dc9a9d75f42b6

SHA1
8d4d844558ef64f0e6289f5922c7428fcaad1bc9

SHA256
00d658968a19e89936dd9db334dda9e4e372852e9f63947436a5f0a03ffdd6a5

SHA512
aa672fb73d988e38d3a3af9158698b469016fea818c196dbe61df9348e1fc4229dacb21250d1f7768b9f2bf8f4d119f90c8a99cb68d148d538c2742bc3f48e49

Download Submit
C:\Windows\SysWOW64\dnfwg.dll

Filesize
30KB

MD5
d45ac07f17b08069cf0dc9a9d75f42b6

SHA1
8d4d844558ef64f0e6289f5922c7428fcaad1bc9

SHA256
00d658968a19e89936dd9db334dda9e4e372852e9f63947436a5f0a03ffdd6a5

SHA512
aa672fb73d988e38d3a3af9158698b469016fea818c196dbe61df9348e1fc4229dacb21250d1f7768b9f2bf8f4d119f90c8a99cb68d148d538c2742bc3f48e49

Download Submit
C:\Windows\SysWOW64\myInsDll.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Windows\SysWOW64\myInsDll.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
C:\Windows\SysWOW64\sfc32.dll

Filesize
48KB

MD5
98c499fccb739ab23b75c0d8b98e0481

SHA1
0ef5c464823550d5f53dd485e91dabc5d5a1ba0a

SHA256
d9d8ce1b86b3978889466ab1b9f46778942d276922bf7533327a493083913087

SHA512
9e64ac13e18ab0a518bb85b6612520645b5ab2c9a5359ced943813ba7344714999f25ba0e52240ad2d0c2fefc76552ff43173adc46334ff0b5dba171fb58e4e6

Download Submit
memory/64-132-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/64-138-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3936-141-0x0000000010000000-0x0000000010108000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing