Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 13:17

General

  • Target

    b65004099cf79cccf769242d739a8c73c74862a6bac9b9f0bd59d5b4f02f7fd0.exe

  • Size

    101KB

  • MD5

    ca9301e98d6801599274fbb82db9ba0b

  • SHA1

    cc29b4bc9e4aaf1685492c9f0c0d174b93cbd360

  • SHA256

    b65004099cf79cccf769242d739a8c73c74862a6bac9b9f0bd59d5b4f02f7fd0

  • SHA512

    257c8d199f9ee3da4752f291b3d366f31afbdf42c5fd412f3a1292e706f38a5aebf4a98a96822c00b927cc3f411debd0122c78ef63ed0fb6da9a2c259baccb1f

  • SSDEEP

    1536:v24UHxpN/MUXsLTvCj0DBXJaO4BPTKfPQODLpHU2bTOTige4n8Nqoi/Q68mVhSJ:e4URpNUUX6z/DBXJfCmPQ+e2sirz

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 15 IoCs

    Detects file using ACProtect software.

  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b65004099cf79cccf769242d739a8c73c74862a6bac9b9f0bd59d5b4f02f7fd0.exe
    "C:\Users\Admin\AppData\Local\Temp\b65004099cf79cccf769242d739a8c73c74862a6bac9b9f0bd59d5b4f02f7fd0.exe"
    1⤵
    • Loads dropped DLL
    PID:2268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    34466cab38abcbc09ffac768d526f896

    SHA1

    2684f5f6c2b005cba812fc8cc1157777554fa3a3

    SHA256

    8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

    SHA512

    5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\inetc.dll

    Filesize

    20KB

    MD5

    c498ae64b4971132bba676873978de1e

    SHA1

    92e4009cd776b6c8616d8bffade7668ef3cb3c27

    SHA256

    5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

    SHA512

    8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • C:\Users\Admin\AppData\Local\Temp\nsc75E1.tmp\nsResize.dll

    Filesize

    4KB

    MD5

    aa849e7407cf349021812f62c001e097

    SHA1

    4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

    SHA256

    29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

    SHA512

    4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

  • memory/2268-150-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-160-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-152-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-151-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-153-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-154-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-155-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-156-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-157-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-158-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-159-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-149-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-161-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-162-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-163-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-164-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-165-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-166-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-168-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-167-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB

  • memory/2268-169-0x0000000073B50000-0x0000000073B59000-memory.dmp

    Filesize

    36KB