Overview

overview

9

Static

static

8

ae155dc991...5e.exe

windows7-x64

9

ae155dc991...5e.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    43s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae155dc991ec1d220880fd54396d304619653995e1bbe5eace9d2e9e5c469d5e.exe

  • Size

    26KB

  • MD5

    cb1362cca1ec9c05473f3a2053e8f6ee

  • SHA1

    e5cc10072e6908855edfa8d075c4d3c29ba9062f

  • SHA256

    ae155dc991ec1d220880fd54396d304619653995e1bbe5eace9d2e9e5c469d5e

  • SHA512

    d9410fb17c32d9f713a5a8534c423f03008b6c1847b598b4e0115e7e21f4a3ec9f8159d37be3a0670df99436eddff05d6534e97a6d9608bd0f048299c5efee2d

  • SSDEEP

    768:bMPnOqDJJJJJJJDzaKqA8NCRj0lfAQTQ2c:mOqDJJJJJJJDzaKJ6CjHQTQ2c

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae155dc991ec1d220880fd54396d304619653995e1bbe5eace9d2e9e5c469d5e.exe
    "C:\Users\Admin\AppData\Local\Temp\ae155dc991ec1d220880fd54396d304619653995e1bbe5eace9d2e9e5c469d5e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AE155D~1.EXE >> NUL
      2⤵
      • Deletes itself
      PID:1020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\122B901E.dll
    Filesize

    18KB

    MD5

    32026eb328adadd1c5749e232c3fa7bd

    SHA1

    ef22fc7e38acd0a0ba205123abc2a6deadcddae1

    SHA256

    52b1318685f82cade3a2b7a63d796c89a48eeec7812e854736089d039d32a808

    SHA512

    007144aa007d01ecd0cc02e28643806e4a803b02384791a67a7b9e9bfe1c79a5a229ca400e07d646dc1c097594545c9a71622c64507d0440ccfc1221a0125f92

    Download Submit

  • memory/1020-58-0x0000000000000000-mapping.dmp

    Download

  • memory/1736-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1736-55-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1736-57-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1736-59-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB

    Download