ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
Size

257KB
MD5

f6aceb1789544f1be51a15f2e202cbf9
SHA1

72aea3626c41b217fc493e3d32ad51ac99ea0163
SHA256

ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028
SHA512

52ba70564607a42c1084cdb75765a2172bb11bb72c8053d4d1cc844170f5692c5b5761ed43da50968d1a83a4a4b77502b50f0cb39cf0fa12368fa6b5648a8494
SSDEEP

6144:W4SUjhtwJ243zJQf/dte57gbwyk+vmPXi:JwJ243zJu/dte576wywi

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 16 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000012322-55.dat	acprotect
behavioral1/files/0x0008000000012322-56.dat	acprotect
behavioral1/files/0x0008000000012322-57.dat	acprotect
behavioral1/files/0x0008000000012322-58.dat	acprotect
behavioral1/files/0x0008000000012322-59.dat	acprotect
behavioral1/files/0x0008000000012322-60.dat	acprotect
behavioral1/files/0x0008000000012322-61.dat	acprotect
behavioral1/files/0x0008000000012322-62.dat	acprotect
behavioral1/files/0x0008000000012322-63.dat	acprotect
behavioral1/files/0x0008000000012322-64.dat	acprotect
behavioral1/files/0x0008000000012322-65.dat	acprotect
behavioral1/files/0x0008000000012322-66.dat	acprotect
behavioral1/files/0x0008000000012322-67.dat	acprotect
behavioral1/files/0x0008000000012322-68.dat	acprotect
behavioral1/files/0x0008000000012322-69.dat	acprotect
behavioral1/memory/1728-77-0x0000000074250000-0x0000000074259000-memory.dmp	acprotect

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012322-55.dat	upx
behavioral1/files/0x0008000000012322-56.dat	upx
behavioral1/files/0x0008000000012322-57.dat	upx
behavioral1/files/0x0008000000012322-58.dat	upx
behavioral1/files/0x0008000000012322-59.dat	upx
behavioral1/files/0x0008000000012322-60.dat	upx
behavioral1/files/0x0008000000012322-61.dat	upx
behavioral1/files/0x0008000000012322-62.dat	upx
behavioral1/files/0x0008000000012322-63.dat	upx
behavioral1/files/0x0008000000012322-64.dat	upx
behavioral1/files/0x0008000000012322-65.dat	upx
behavioral1/files/0x0008000000012322-66.dat	upx
behavioral1/files/0x0008000000012322-67.dat	upx
behavioral1/files/0x0008000000012322-68.dat	upx
behavioral1/files/0x0008000000012322-69.dat	upx
behavioral1/memory/1728-77-0x0000000074250000-0x0000000074259000-memory.dmp	upx

Loads dropped DLL 16 IoCs

pid	Process
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
1728	ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe
"C:\Users\Admin\AppData\Local\Temp\ab1a16ba633432ab43aa03b5df7712dcd604375d13685a59e8ad965d2cb51028.exe"
1⤵
- Loads dropped DLL
PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\InstallOptions.dll

Filesize
14KB

MD5
34466cab38abcbc09ffac768d526f896

SHA1
2684f5f6c2b005cba812fc8cc1157777554fa3a3

SHA256
8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

SHA512
5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsy9B3.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/1728-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1728-73-0x0000000074250000-0x0000000074259000-memory.dmp

Filesize
36KB

Download
memory/1728-72-0x0000000074250000-0x0000000074259000-memory.dmp

Filesize
36KB

Download
memory/1728-71-0x0000000074260000-0x0000000074269000-memory.dmp

Filesize
36KB

Download
memory/1728-77-0x0000000074250000-0x0000000074259000-memory.dmp

Filesize
36KB

Download
memory/1728-76-0x0000000074260000-0x0000000074269000-memory.dmp

Filesize
36KB

Download
memory/1728-75-0x0000000074250000-0x0000000074259000-memory.dmp

Filesize
36KB

Download
memory/1728-74-0x0000000074260000-0x0000000074269000-memory.dmp

Filesize
36KB

Download