Analysis

  • max time kernel
    192s
  • max time network
    218s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 09:38

General

  • Target

    d35d5ba46cf8fa7e14d2826eac6c1871fdd64f7068f998476e8779379724abf2.exe

  • Size

    11.4MB

  • MD5

    3320bcc3a59e0d3996d371c176c563b4

  • SHA1

    9ca9403feef99bdf926d03f388cf0b669ca7feba

  • SHA256

    d35d5ba46cf8fa7e14d2826eac6c1871fdd64f7068f998476e8779379724abf2

  • SHA512

    efdf091998dae21cf6cd32116501b09fee210508868714834b1c98b1dcc2d8e8714e7c3189270d477b3e64d5f1e6f82b841696355cd5cf7d82d4308a73f3ebb9

  • SSDEEP

    196608:WgEA/9rpKhj2vTq+Zs8BNMH2W/3FZg39wo2vBHehFXXxtndw/HctJrb3FL:WgEQrQhjmJ9BSH3/3ktwo2vtehVXHy0B

Score
9/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d35d5ba46cf8fa7e14d2826eac6c1871fdd64f7068f998476e8779379724abf2.exe
    "C:\Users\Admin\AppData\Local\Temp\d35d5ba46cf8fa7e14d2826eac6c1871fdd64f7068f998476e8779379724abf2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\Sqzrkiizsapz.exe
      "C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\Sqzrkiizsapz.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2940
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 1524
        3⤵
        • Program crash
        PID:832
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2940 -ip 2940
    1⤵
      PID:1812

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils.dll

      Filesize

      791KB

      MD5

      2b0f384cdffe65ed7e19bbe3deb512d6

      SHA1

      02d8964aab30350a0a91d99799fba4c5ee710082

      SHA256

      17ce0d4e1961f6cd6c04fb30b4e680e009a1664375acfdc3c129aac0eea60da9

      SHA512

      296bfa4ad1b7d31e8018d03d472b74c6a89c577301fb5a2cac0ceb16b51244d18c9e7a7e74decfb2730a589dcb9a1f4aea8d9b021b1c6a2d6c693b9fd178ff99

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils.dll

      Filesize

      791KB

      MD5

      2b0f384cdffe65ed7e19bbe3deb512d6

      SHA1

      02d8964aab30350a0a91d99799fba4c5ee710082

      SHA256

      17ce0d4e1961f6cd6c04fb30b4e680e009a1664375acfdc3c129aac0eea60da9

      SHA512

      296bfa4ad1b7d31e8018d03d472b74c6a89c577301fb5a2cac0ceb16b51244d18c9e7a7e74decfb2730a589dcb9a1f4aea8d9b021b1c6a2d6c693b9fd178ff99

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils.dll

      Filesize

      791KB

      MD5

      2b0f384cdffe65ed7e19bbe3deb512d6

      SHA1

      02d8964aab30350a0a91d99799fba4c5ee710082

      SHA256

      17ce0d4e1961f6cd6c04fb30b4e680e009a1664375acfdc3c129aac0eea60da9

      SHA512

      296bfa4ad1b7d31e8018d03d472b74c6a89c577301fb5a2cac0ceb16b51244d18c9e7a7e74decfb2730a589dcb9a1f4aea8d9b021b1c6a2d6c693b9fd178ff99

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils.dll

      Filesize

      791KB

      MD5

      2b0f384cdffe65ed7e19bbe3deb512d6

      SHA1

      02d8964aab30350a0a91d99799fba4c5ee710082

      SHA256

      17ce0d4e1961f6cd6c04fb30b4e680e009a1664375acfdc3c129aac0eea60da9

      SHA512

      296bfa4ad1b7d31e8018d03d472b74c6a89c577301fb5a2cac0ceb16b51244d18c9e7a7e74decfb2730a589dcb9a1f4aea8d9b021b1c6a2d6c693b9fd178ff99

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils.dll

      Filesize

      791KB

      MD5

      2b0f384cdffe65ed7e19bbe3deb512d6

      SHA1

      02d8964aab30350a0a91d99799fba4c5ee710082

      SHA256

      17ce0d4e1961f6cd6c04fb30b4e680e009a1664375acfdc3c129aac0eea60da9

      SHA512

      296bfa4ad1b7d31e8018d03d472b74c6a89c577301fb5a2cac0ceb16b51244d18c9e7a7e74decfb2730a589dcb9a1f4aea8d9b021b1c6a2d6c693b9fd178ff99

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils.dll

      Filesize

      791KB

      MD5

      2b0f384cdffe65ed7e19bbe3deb512d6

      SHA1

      02d8964aab30350a0a91d99799fba4c5ee710082

      SHA256

      17ce0d4e1961f6cd6c04fb30b4e680e009a1664375acfdc3c129aac0eea60da9

      SHA512

      296bfa4ad1b7d31e8018d03d472b74c6a89c577301fb5a2cac0ceb16b51244d18c9e7a7e74decfb2730a589dcb9a1f4aea8d9b021b1c6a2d6c693b9fd178ff99

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\InstallerUtils2.dll

      Filesize

      92KB

      MD5

      b2ac51006b9377937776506c2dea3729

      SHA1

      2ee5025c368e1c1819c57aea805bc69609feb2ae

      SHA256

      cc41fde385335c7c3811253f3ab4aca51245b523b8437af892f77b43f0ada11b

      SHA512

      e1c25695e622c893b128d8b2c0a0500807e3eac7181bd7c8eeb5cffaea3b15c9ee05be0a8a9fab40418aea61ff2de2f31a4f5e606f3b1c990450b9e11e42b1ea

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\StdUtils.dll

      Filesize

      14KB

      MD5

      21010df9bc37daffcc0b5ae190381d85

      SHA1

      a8ba022aafc1233894db29e40e569dfc8b280eb9

      SHA256

      0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

      SHA512

      95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\System.dll

      Filesize

      11KB

      MD5

      00a0194c20ee912257df53bfe258ee4a

      SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

      SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

      SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      7579ade7ae1747a31960a228ce02e666

      SHA1

      8ec8571a296737e819dcf86353a43fcf8ec63351

      SHA256

      564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

      SHA512

      a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\UserInfo.dll

      Filesize

      4KB

      MD5

      7579ade7ae1747a31960a228ce02e666

      SHA1

      8ec8571a296737e819dcf86353a43fcf8ec63351

      SHA256

      564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

      SHA512

      a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\md5dll.dll

      Filesize

      6KB

      MD5

      0745ff646f5af1f1cdd784c06f40fce9

      SHA1

      bf7eba06020d7154ce4e35f696bec6e6c966287f

      SHA256

      fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

      SHA512

      8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\md5dll.dll

      Filesize

      6KB

      MD5

      0745ff646f5af1f1cdd784c06f40fce9

      SHA1

      bf7eba06020d7154ce4e35f696bec6e6c966287f

      SHA256

      fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

      SHA512

      8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\md5dll.dll

      Filesize

      6KB

      MD5

      0745ff646f5af1f1cdd784c06f40fce9

      SHA1

      bf7eba06020d7154ce4e35f696bec6e6c966287f

      SHA256

      fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

      SHA512

      8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\md5dll.dll

      Filesize

      6KB

      MD5

      0745ff646f5af1f1cdd784c06f40fce9

      SHA1

      bf7eba06020d7154ce4e35f696bec6e6c966287f

      SHA256

      fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

      SHA512

      8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\nsisos.dll

      Filesize

      5KB

      MD5

      69806691d649ef1c8703fd9e29231d44

      SHA1

      e2193fcf5b4863605eec2a5eb17bf84c7ac00166

      SHA256

      ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

      SHA512

      5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

    • C:\Users\Admin\AppData\Local\Temp\nsj5B2D.tmp\nsisos.dll

      Filesize

      5KB

      MD5

      69806691d649ef1c8703fd9e29231d44

      SHA1

      e2193fcf5b4863605eec2a5eb17bf84c7ac00166

      SHA256

      ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

      SHA512

      5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

    • C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\Sqzrkiizsapz.exe

      Filesize

      11.2MB

      MD5

      d6f0c016905921fe0419537fe2b14590

      SHA1

      5af02c7120e2bfb2a95a90fbdd6d8508f3e873d0

      SHA256

      7cab5cfa15fa956d5b1c7397e9e08a90e9358ec6b383dca82529fab5733fb4cc

      SHA512

      892e8b1e40c2683aa8546bf8d6a665befc7c419dce0143511e7bd06782ef106c77cdaab33e4461b84025ee503a173ab95e120bc9bb2df05afb9d15b1983eb253

    • C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\Sqzrkiizsapz.exe

      Filesize

      11.2MB

      MD5

      d6f0c016905921fe0419537fe2b14590

      SHA1

      5af02c7120e2bfb2a95a90fbdd6d8508f3e873d0

      SHA256

      7cab5cfa15fa956d5b1c7397e9e08a90e9358ec6b383dca82529fab5733fb4cc

      SHA512

      892e8b1e40c2683aa8546bf8d6a665befc7c419dce0143511e7bd06782ef106c77cdaab33e4461b84025ee503a173ab95e120bc9bb2df05afb9d15b1983eb253

    • C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\StdUtils.dll

      Filesize

      14KB

      MD5

      21010df9bc37daffcc0b5ae190381d85

      SHA1

      a8ba022aafc1233894db29e40e569dfc8b280eb9

      SHA256

      0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

      SHA512

      95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

    • C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\System.dll

      Filesize

      11KB

      MD5

      00a0194c20ee912257df53bfe258ee4a

      SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

      SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

      SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • C:\Users\Admin\AppData\Local\Temp\nsr637F.tmp\WrapperUtils.dll

      Filesize

      57KB

      MD5

      e9ca2738e895ace7506ba5d9bc1f83f5

      SHA1

      f97fe66d59e57153f469c87d10d65db1968febf1

      SHA256

      6b5d0a99001065ba2ce3a5097008b2f73a5361f879ebe81d0f3fad2a812454eb

      SHA512

      77181912b838621223a56043f084de1c6767eda70572941a835bcf5b53a9fd1d711b30f625e928577963557d5d37ba7a5cdde0ef68a9e2c757325be1c5155dec

    • memory/2940-135-0x0000000000000000-mapping.dmp

    • memory/2940-154-0x0000000004120000-0x0000000004129000-memory.dmp

      Filesize

      36KB

    • memory/2940-155-0x0000000004120000-0x0000000004129000-memory.dmp

      Filesize

      36KB

    • memory/2940-157-0x0000000004120000-0x0000000004129000-memory.dmp

      Filesize

      36KB

    • memory/2940-158-0x0000000004120000-0x0000000004129000-memory.dmp

      Filesize

      36KB

    • memory/2940-159-0x0000000004120000-0x0000000004129000-memory.dmp

      Filesize

      36KB

    • memory/2940-160-0x0000000004120000-0x0000000004129000-memory.dmp

      Filesize

      36KB