Analysis

  • max time kernel
    148s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:45

General

  • Target

    9d89d4e11b90b6016c3296955b46013d406ec29b4e7c0e6c03941c46246f2fc8.exe

  • Size

    112KB

  • MD5

    168b755c2e401f57c9dfd0c4a8ac0fee

  • SHA1

    c7bede71fba25c679ba6c925474f30224a915b4a

  • SHA256

    9d89d4e11b90b6016c3296955b46013d406ec29b4e7c0e6c03941c46246f2fc8

  • SHA512

    7b173157e0b75eb26ca465019b98f50be22c37e5fc903cc2fe9b015263104ea4bc8108c978e87c185d4a58e61bb14369d8c85a69cefcadf7a35210df2743fccc

  • SSDEEP

    3072:X4URpNUUX6z/DBXJfyUJjzmb3vWmPQ+e2sir1/:X4SUjhtyU1zmDemPJFD/

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 17 IoCs

    Detects file using ACProtect software.

  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d89d4e11b90b6016c3296955b46013d406ec29b4e7c0e6c03941c46246f2fc8.exe
    "C:\Users\Admin\AppData\Local\Temp\9d89d4e11b90b6016c3296955b46013d406ec29b4e7c0e6c03941c46246f2fc8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    34466cab38abcbc09ffac768d526f896

    SHA1

    2684f5f6c2b005cba812fc8cc1157777554fa3a3

    SHA256

    8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

    SHA512

    5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\inetc.dll

    Filesize

    20KB

    MD5

    c498ae64b4971132bba676873978de1e

    SHA1

    92e4009cd776b6c8616d8bffade7668ef3cb3c27

    SHA256

    5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

    SHA512

    8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • \Users\Admin\AppData\Local\Temp\nstAA74.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • memory/1868-75-0x0000000074110000-0x0000000074119000-memory.dmp

    Filesize

    36KB

  • memory/1868-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

    Filesize

    8KB

  • memory/1868-74-0x0000000074110000-0x0000000074119000-memory.dmp

    Filesize

    36KB

  • memory/1868-73-0x0000000074110000-0x0000000074119000-memory.dmp

    Filesize

    36KB

  • memory/1868-72-0x0000000074100000-0x0000000074109000-memory.dmp

    Filesize

    36KB

  • memory/1868-57-0x0000000074110000-0x0000000074119000-memory.dmp

    Filesize

    36KB

  • memory/1868-79-0x0000000074110000-0x0000000074119000-memory.dmp

    Filesize

    36KB

  • memory/1868-78-0x0000000074100000-0x0000000074109000-memory.dmp

    Filesize

    36KB

  • memory/1868-77-0x0000000074110000-0x0000000074119000-memory.dmp

    Filesize

    36KB