31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513

Analysis

max time kernel
182s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
Size

112KB
MD5

4d97c4bfe82a9ce81e7a0550b9fb77b7
SHA1

b1b285cbedd68d92cd70d067092b93c77dfb9eb1
SHA256

31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513
SHA512

4e190fc2365e6e7777f9027936fe4a2cd1bc89947accd0528820e26fb302d1c259a63323cb8fe58080b9b01a62ef9c9a0bde2b61b9d0780700196ce67d1b2e4a
SSDEEP

3072:+4URpNUUX6z/DBXJfyUJjzmb3gmPQ+e2sir+:+4SUjhtyU1zmDgmPJF8

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 16 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	acprotect
behavioral2/memory/1568-158-0x0000000073830000-0x0000000073839000-memory.dmp	acprotect

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll	upx
behavioral2/memory/1568-158-0x0000000073830000-0x0000000073839000-memory.dmp	upx

Loads dropped DLL 17 IoCs

Processes:

31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe

pid	process
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
1568	31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe
"C:\Users\Admin\AppData\Local\Temp\31936d99832dfe6e421927bf50d3214c832c5338ae88f59b32b86810a4232513.exe"
1⤵
- Loads dropped DLL
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\InstallOptions.dll
Filesize
14KB

MD5
34466cab38abcbc09ffac768d526f896

SHA1
2684f5f6c2b005cba812fc8cc1157777554fa3a3

SHA256
8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

SHA512
5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\inetc.dll
Filesize
20KB

MD5
c498ae64b4971132bba676873978de1e

SHA1
92e4009cd776b6c8616d8bffade7668ef3cb3c27

SHA256
5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

SHA512
8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv7A90.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/1568-153-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-158-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-151-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-152-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-149-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-154-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-155-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-156-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-157-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-150-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-159-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-160-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-161-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-162-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-163-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-164-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-165-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download
memory/1568-166-0x0000000073830000-0x0000000073839000-memory.dmp

Filesize
36KB

Download