Analysis
-
max time kernel
168s -
max time network
227s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:45
Static task
static1
Behavioral task
behavioral1
Sample
c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe
Resource
win10v2004-20221111-en
General
-
Target
c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe
-
Size
112KB
-
MD5
3b3911e336518ba83d614c02aa613887
-
SHA1
2736caba94c9d00dab5e379b821a6ad934ef243a
-
SHA256
c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b
-
SHA512
69c4877290565e22be364990196a699e4be372efc7a72307e55a88245288b712bc3a213981aa6bb02f082d71640555d6c1592ef10f064af9a78765a5a5d0b572
-
SSDEEP
3072:a4URpNUUX6z/DBXJfyUJjzmb3PX2mPQ+e2sirx:a4SUjhtyU1zmDf2mPJFP
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect behavioral1/memory/1168-57-0x0000000073D30000-0x0000000073D39000-memory.dmp acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx behavioral1/memory/1168-57-0x0000000073D30000-0x0000000073D39000-memory.dmp upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx \Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dll upx -
Loads dropped DLL 17 IoCs
Processes:
c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exepid process 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe 1168 c860911d58c2034c794f71a271edf4a6d99fb735bd8241e7e7567f309488841b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\InstallOptions.dllFilesize
14KB
MD534466cab38abcbc09ffac768d526f896
SHA12684f5f6c2b005cba812fc8cc1157777554fa3a3
SHA2568b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c
SHA5125c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\inetc.dllFilesize
20KB
MD5c498ae64b4971132bba676873978de1e
SHA192e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA2565552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA5128e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
\Users\Admin\AppData\Local\Temp\nsj711C.tmp\nsResize.dllFilesize
4KB
MD5aa849e7407cf349021812f62c001e097
SHA14cbb55b1d1dd95dcb7a36b5a44121ad4934539af
SHA25629b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5
SHA5124556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de
-
memory/1168-75-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-57-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-78-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-79-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-77-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-76-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-54-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/1168-74-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-73-0x0000000073D20000-0x0000000073D29000-memory.dmpFilesize
36KB
-
memory/1168-80-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-86-0x0000000073D20000-0x0000000073D29000-memory.dmpFilesize
36KB
-
memory/1168-91-0x0000000073D20000-0x0000000073D29000-memory.dmpFilesize
36KB
-
memory/1168-90-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-89-0x0000000073D20000-0x0000000073D29000-memory.dmpFilesize
36KB
-
memory/1168-88-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-87-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-85-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-84-0x0000000073D20000-0x0000000073D29000-memory.dmpFilesize
36KB
-
memory/1168-83-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-82-0x0000000073D20000-0x0000000073D29000-memory.dmpFilesize
36KB
-
memory/1168-81-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB
-
memory/1168-92-0x0000000073D30000-0x0000000073D39000-memory.dmpFilesize
36KB