c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16.exe
Size

292KB
MD5

07e03afa063561e64220d320645c2350
SHA1

702432cbcce8ec23cee4a775c419883ec4412d76
SHA256

c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16
SHA512

c5273a54d7f5ca4398574e79af34c55b21c5b9b5571d5dee6b11dece203cd6006a17406de9dd0a06b6105a5356d2d1ab48924816431b1a8418ecdc4e5d5a0e7c
SSDEEP

6144:3WFhyu09dMg1gtpX/NclnzI97YL5j1RtlSOvV:3WKu09WgCtpX/4IF25ZdV

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022f5c-133.dat	acprotect
behavioral2/files/0x0006000000022f5c-134.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4684	c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16.exe
4684	c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4684	c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16.exe

C:\Users\Admin\AppData\Local\Temp\c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16.exe
"C:\Users\Admin\AppData\Local\Temp\c0d5c7e8b5125fe6333dd3c79c2ee3348b53e7bbafce0f28f6ee7e8a912eef16.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fai436.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\fai436.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/4684-132-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4684-135-0x0000000000640000-0x00000000006B3000-memory.dmp

Filesize
460KB

Download
memory/4684-136-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4684-137-0x0000000000640000-0x00000000006B3000-memory.dmp

Filesize
460KB

Download