6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c

General

Target

6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe
Size

196KB
MD5

3063f0d6c61c65d9bfc0f327185bb0e0
SHA1

ad8ae499de66458695f407451c6906d46e36b1b0
SHA256

6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c
SHA512

20f375b2cc9a2de51fd21de8e1d606263c364dd4bae01ff48bd4f6572ba46632006483d0390a75cfd2e82e8c0a247c02a73b2a57f7645f04475f7df4464c62ad
SSDEEP

3072:8UcMLHmHM3d7cJ57KuVooJz3z9oGDyZl2coGP3GFsQYR4PXatgeUKK9O00H8/uFf:ncMys3d7MJoeRoGDyjQDYPg7Z5Snn

Score

9^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	acprotect
behavioral1/files/0x000800000001435a-56.dat	acprotect
behavioral1/files/0x000800000001435a-57.dat	acprotect

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001435a-56.dat	upx
behavioral1/files/0x000800000001435a-57.dat	upx
behavioral1/memory/1528-60-0x0000000074580000-0x000000007458F000-memory.dmp	upx
behavioral1/memory/1456-61-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
2024	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1456	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe
1528	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\FastUserSwitchingCompatibility.dll	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe
File created	C:\Windows\SysWOW64\dllcache\systembox.bak	cmd.exe
File created	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2024	1456	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe	27
PID 1456 wrote to memory of 2024	1456	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe	27
PID 1456 wrote to memory of 2024	1456	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe	27
PID 1456 wrote to memory of 2024	1456	6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe	27

C:\Users\Admin\AppData\Local\Temp\6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe
"C:\Users\Admin\AppData\Local\Temp\6803b46a8004481ef5a1751aa6a0b3841cfd95061af6fe344416e527babb5c4c.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "
  2⤵
  - Deletes itself
  - Drops file in System32 directory
  PID:2024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TempDel.bat

Filesize
462B

MD5
4328368845bc62ec49abb866f68d9bf4

SHA1
d05f3955bc7677e33674b1ecfa5d2bce5ea84bea

SHA256
6852fd2e97222d07f684888c80361ab3408e77831dc036f24f27f3c5387355b4

SHA512
45ab3ef0b0b19b8a4f77878807ce9cf1cd3ee8dfd7e5506bfc674a89d01dc29fcafca7d96203bcf54ec9a19b93de5b256d2c419a569e70f5971961a77aa49055

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
19KB

MD5
36a9a2fe9bbbda35d4f588d9a0dbb115

SHA1
731651fa525c4243b551315084b58a1b7baa320b

SHA256
18815662ef99aef7ee58e5d5062f0899228c273915e1d7fe673d958bc9716e18

SHA512
d7258add94f731d0d2f1b48958fe214e9a79c59815d5cdba0da0dc0cc43fadabe8eaf5f251ff6fd1c5cb74689c1171ad6223cb1be8350b9d454a255ea7b4c66a

Download Submit
\Users\Admin\AppData\Local\Temp\vfk32D4.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
19KB

MD5
36a9a2fe9bbbda35d4f588d9a0dbb115

SHA1
731651fa525c4243b551315084b58a1b7baa320b

SHA256
18815662ef99aef7ee58e5d5062f0899228c273915e1d7fe673d958bc9716e18

SHA512
d7258add94f731d0d2f1b48958fe214e9a79c59815d5cdba0da0dc0cc43fadabe8eaf5f251ff6fd1c5cb74689c1171ad6223cb1be8350b9d454a255ea7b4c66a

Download Submit
memory/1456-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1456-61-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1456-62-0x0000000000250000-0x00000000002C3000-memory.dmp

Filesize
460KB

Download
memory/1528-60-0x0000000074580000-0x000000007458F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing