Analysis
-
max time kernel
24s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:43
Static task
static1
Behavioral task
behavioral1
Sample
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe
Resource
win10v2004-20220812-en
General
-
Target
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe
-
Size
2.2MB
-
MD5
10cd5734c6f11561bb2d3f386000fb17
-
SHA1
12d3158d6c93c8c9dc942accbc5249db0b210ad2
-
SHA256
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6
-
SHA512
fb371554d75cf7873c7531f2da9e39980af863c4ba12252715b2bbe52c7a63dc4c7fd4a273c469c0f8dfa00231daa6a82976c043ba303ffd0fc1a6ce9927b946
-
SSDEEP
24576:nit5hHI87j+Fnj+ft9rkswm8lf9q06hMOKZ9kL8fEOlr4QGHfmdi3KPePVvd9wYa:niXhEJqt6swV4xrKnFfrreHFtvdVzJOP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Protector-nore.exepid process 2020 Protector-nore.exe -
Processes:
resource yara_rule behavioral1/memory/900-55-0x0000000000400000-0x0000000000767000-memory.dmp upx behavioral1/memory/900-56-0x0000000000400000-0x000000000099E000-memory.dmp upx behavioral1/memory/900-58-0x0000000000400000-0x000000000099E000-memory.dmp upx behavioral1/memory/2020-66-0x0000000000400000-0x0000000000767000-memory.dmp upx behavioral1/memory/900-69-0x0000000000400000-0x0000000000767000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exepid process 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exeProtector-nore.exedescription pid process Token: SeDebugPrivilege 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe Token: SeShutdownPrivilege 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe Token: SeDebugPrivilege 2020 Protector-nore.exe Token: SeShutdownPrivilege 2020 Protector-nore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exeProtector-nore.exepid process 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe 2020 Protector-nore.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exedescription pid process target process PID 900 wrote to memory of 2020 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe Protector-nore.exe PID 900 wrote to memory of 2020 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe Protector-nore.exe PID 900 wrote to memory of 2020 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe Protector-nore.exe PID 900 wrote to memory of 2020 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe Protector-nore.exe PID 900 wrote to memory of 1640 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe cmd.exe PID 900 wrote to memory of 1640 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe cmd.exe PID 900 wrote to memory of 1640 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe cmd.exe PID 900 wrote to memory of 1640 900 f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe"C:\Users\Admin\AppData\Local\Temp\f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Roaming\Protector-nore.exeC:\Users\Admin\AppData\Roaming\Protector-nore.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\F34E46~1.EXE" >> NUL2⤵PID:1640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Protector-nore.exeFilesize
2.2MB
MD510cd5734c6f11561bb2d3f386000fb17
SHA112d3158d6c93c8c9dc942accbc5249db0b210ad2
SHA256f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6
SHA512fb371554d75cf7873c7531f2da9e39980af863c4ba12252715b2bbe52c7a63dc4c7fd4a273c469c0f8dfa00231daa6a82976c043ba303ffd0fc1a6ce9927b946
-
C:\Users\Admin\AppData\Roaming\Protector-nore.exeFilesize
2.2MB
MD510cd5734c6f11561bb2d3f386000fb17
SHA112d3158d6c93c8c9dc942accbc5249db0b210ad2
SHA256f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6
SHA512fb371554d75cf7873c7531f2da9e39980af863c4ba12252715b2bbe52c7a63dc4c7fd4a273c469c0f8dfa00231daa6a82976c043ba303ffd0fc1a6ce9927b946
-
\Users\Admin\AppData\Roaming\Protector-nore.exeFilesize
2.2MB
MD510cd5734c6f11561bb2d3f386000fb17
SHA112d3158d6c93c8c9dc942accbc5249db0b210ad2
SHA256f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6
SHA512fb371554d75cf7873c7531f2da9e39980af863c4ba12252715b2bbe52c7a63dc4c7fd4a273c469c0f8dfa00231daa6a82976c043ba303ffd0fc1a6ce9927b946
-
\Users\Admin\AppData\Roaming\Protector-nore.exeFilesize
2.2MB
MD510cd5734c6f11561bb2d3f386000fb17
SHA112d3158d6c93c8c9dc942accbc5249db0b210ad2
SHA256f34e46d37ac5ae09ff842fbd4bcb385adcca8b637ec509001f48fca07d5ef8e6
SHA512fb371554d75cf7873c7531f2da9e39980af863c4ba12252715b2bbe52c7a63dc4c7fd4a273c469c0f8dfa00231daa6a82976c043ba303ffd0fc1a6ce9927b946
-
memory/900-58-0x0000000000400000-0x000000000099E000-memory.dmpFilesize
5.6MB
-
memory/900-57-0x0000000074370000-0x00000000743E9000-memory.dmpFilesize
484KB
-
memory/900-54-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB
-
memory/900-56-0x0000000000400000-0x000000000099E000-memory.dmpFilesize
5.6MB
-
memory/900-55-0x0000000000400000-0x0000000000767000-memory.dmpFilesize
3.4MB
-
memory/900-69-0x0000000000400000-0x0000000000767000-memory.dmpFilesize
3.4MB
-
memory/900-70-0x0000000074370000-0x00000000743E9000-memory.dmpFilesize
484KB
-
memory/1640-68-0x0000000000000000-mapping.dmp
-
memory/2020-61-0x0000000000000000-mapping.dmp
-
memory/2020-67-0x0000000074370000-0x00000000743E9000-memory.dmpFilesize
484KB
-
memory/2020-66-0x0000000000400000-0x0000000000767000-memory.dmpFilesize
3.4MB