8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
Size

365KB
MD5

c906481cf5269df97338607d4522e19a
SHA1

0e2c4f4eec821afa4accb61ee1939a5f09fcbe7d
SHA256

8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e
SHA512

13999e1d9ddcfb27fb70854ff0d41865069e859f6dc1de359eda1c0f5aa23453867cbfc123628aa94989fe653ef76e036b590ef6c597bc09f881f39fccf8ba86
SSDEEP

6144:w4SUjhtItxwV3vaHIIeHL+iXFBwTw0cl7FNmPJFx:XItxwV3vaHIIBeUd6qFx

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 19 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
behavioral1/memory/1884-57-0x0000000073D80000-0x0000000073D89000-memory.dmp	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	acprotect
behavioral1/memory/1884-72-0x0000000073D70000-0x0000000073D79000-memory.dmp	acprotect
behavioral1/memory/1884-80-0x0000000073D70000-0x0000000073D79000-memory.dmp	acprotect
behavioral1/memory/1884-77-0x0000000073D70000-0x0000000073D79000-memory.dmp	acprotect

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
behavioral1/memory/1884-57-0x0000000073D80000-0x0000000073D89000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll	upx
behavioral1/memory/1884-72-0x0000000073D70000-0x0000000073D79000-memory.dmp	upx
behavioral1/memory/1884-80-0x0000000073D70000-0x0000000073D79000-memory.dmp	upx
behavioral1/memory/1884-77-0x0000000073D70000-0x0000000073D79000-memory.dmp	upx

Loads dropped DLL 17 IoCs

Processes:

8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe

pid	process
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
1884	8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe
"C:\Users\Admin\AppData\Local\Temp\8e74bc6ab5bc9fc19718a8f83d02b714b55e06b91ac88c826c5d3ee41b98ec6e.exe"
1⤵
- Loads dropped DLL
PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\InstallOptions.dll
Filesize
14KB

MD5
34466cab38abcbc09ffac768d526f896

SHA1
2684f5f6c2b005cba812fc8cc1157777554fa3a3

SHA256
8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

SHA512
5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\inetc.dll
Filesize
20KB

MD5
c498ae64b4971132bba676873978de1e

SHA1
92e4009cd776b6c8616d8bffade7668ef3cb3c27

SHA256
5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

SHA512
8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nsdFEA.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/1884-75-0x0000000073D80000-0x0000000073D89000-memory.dmp

Filesize
36KB

Download
memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1884-74-0x0000000073D80000-0x0000000073D89000-memory.dmp

Filesize
36KB

Download
memory/1884-73-0x0000000073D80000-0x0000000073D89000-memory.dmp

Filesize
36KB

Download
memory/1884-72-0x0000000073D70000-0x0000000073D79000-memory.dmp

Filesize
36KB

Download
memory/1884-57-0x0000000073D80000-0x0000000073D89000-memory.dmp

Filesize
36KB

Download
memory/1884-80-0x0000000073D70000-0x0000000073D79000-memory.dmp

Filesize
36KB

Download
memory/1884-79-0x0000000073D80000-0x0000000073D89000-memory.dmp

Filesize
36KB

Download
memory/1884-78-0x0000000073D70000-0x0000000073D79000-memory.dmp

Filesize
36KB

Download
memory/1884-77-0x0000000073D70000-0x0000000073D79000-memory.dmp

Filesize
36KB

Download