0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7

Analysis

max time kernel
68s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
Size

27.6MB
MD5

c124d3ef34a2e55e739c61420570a3d1
SHA1

eb577915981e16cb593df26d3efc8c0b4a975de7
SHA256

0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7
SHA512

3aae70e472c43c4984a3fa6e1614fbc15e50b814c918a236b333806cea0b4e166cea8e07c42c1edc236e6dcfcb324eace18cc6765cbf471efc3134780c8431f7
SSDEEP

786432:ceXCiRPSfLdbhEPy4wrAzdGfKc+HovYIr2Kkr:7/SfTYy4vzdaKc+I1o

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsRandom.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsRandom.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsRandom.dll	upx
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsRandom.dll	upx

Loads dropped DLL 11 IoCs

Processes:

0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe

pid	process
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4572	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4592	4572	WerFault.exe	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
4280	4572	WerFault.exe	0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe

pid process

4572 0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe

C:\Users\Admin\AppData\Local\Temp\0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe
"C:\Users\Admin\AppData\Local\Temp\0d5da7ebf634dca329117aecc6a025ee36e92216e7e837d830db9fe58ed38fe7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1280
2⤵
- Program crash
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1280
2⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4572 -ip 4572
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4572 -ip 4572
1⤵
PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\979368\MyNsisSkin.dll
Filesize
324KB

MD5
c42575c6e2e273c04eb7bc3e4119e337

SHA1
658e3d042e28196a321ee6446b9e6845d5478abc

SHA256
9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736

SHA512
b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308

Download Submit
C:\Users\Admin\AppData\Local\Temp\979368\MyNsisSkin.dll
Filesize
324KB

MD5
c42575c6e2e273c04eb7bc3e4119e337

SHA1
658e3d042e28196a321ee6446b9e6845d5478abc

SHA256
9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736

SHA512
b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\ButtonEvent.dll
Filesize
4KB

MD5
fad9d09fc0267e8513b8628e767b2604

SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300

SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\ButtonEvent.dll
Filesize
4KB

MD5
fad9d09fc0267e8513b8628e767b2604

SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300

SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\MyNsisExtend.dll
Filesize
536KB

MD5
ae20c78878bffd789a4f900d420a47fd

SHA1
166bb9311a99a4bb42dcb9337e704e0248ca8f58

SHA256
7690f9653732bf3d8ec0b0a89eaf6763171864d23bb41971e5b9649bbea80b60

SHA512
c0a9b177ca962e5fcd308c49e2f71afdb7d9498ef80547b2febece9765df6bb6f0d0623518aff22bf908189f26a8e1fb9aa326e9790501465d9e985f9993595b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\MyNsisExtend.dll
Filesize
536KB

MD5
ae20c78878bffd789a4f900d420a47fd

SHA1
166bb9311a99a4bb42dcb9337e704e0248ca8f58

SHA256
7690f9653732bf3d8ec0b0a89eaf6763171864d23bb41971e5b9649bbea80b60

SHA512
c0a9b177ca962e5fcd308c49e2f71afdb7d9498ef80547b2febece9765df6bb6f0d0623518aff22bf908189f26a8e1fb9aa326e9790501465d9e985f9993595b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsRandom.dll
Filesize
21KB

MD5
ab467b8dfaa660a0f0e5b26e28af5735

SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d

SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspC819.tmp\nsRandom.dll
Filesize
21KB

MD5
ab467b8dfaa660a0f0e5b26e28af5735

SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d

SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

Download Submit
memory/4572-137-0x0000000002311000-0x0000000002352000-memory.dmp

Filesize
260KB

Download
memory/4572-143-0x0000000002310000-0x0000000002322000-memory.dmp

Filesize
72KB

Download
memory/4572-146-0x0000000004451000-0x0000000004453000-memory.dmp

Filesize
8KB

Download
memory/4572-141-0x0000000003240000-0x00000000032CB000-memory.dmp

Filesize
556KB

Download
memory/4572-138-0x0000000002310000-0x0000000002363000-memory.dmp

Filesize
332KB

Download