4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2

Analysis

max time kernel
71s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
Size

101KB
MD5

192aa055546a4f905dc2ff8fcfc23c3b
SHA1

49e36dfb4a6ff65c0c887fc0c0b8b9ca0127f792
SHA256

4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2
SHA512

2e76414de95ed2a672468a3564cafcdb319d21d9158536f1d49a27000ad31e18401aa5f5f277f80a19bd1a7d4a13c1a1acf4e938859a9bb0bcd6d9f06aa9ff63
SSDEEP

1536:C4UHxpN/MUXsLTvCj0DBXJaOTNH2KfPQODLpHU2bTOTige4n8Nqoi/Q68mqhI:C4URpNUUX6z/DBXJfpWmPQ+e2sir0

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 15 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	acprotect

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll	upx

Loads dropped DLL 17 IoCs

Processes:

4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe

pid	process
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
3484	4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe
"C:\Users\Admin\AppData\Local\Temp\4c550f560feb4b630afb07c79a980efaea70bfdd81fb282ca13bca65c9ee7ac2.exe"
1⤵
- Loads dropped DLL
PID:3484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\InstallOptions.dll

Filesize
14KB

MD5
34466cab38abcbc09ffac768d526f896

SHA1
2684f5f6c2b005cba812fc8cc1157777554fa3a3

SHA256
8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

SHA512
5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\inetc.dll

Filesize
20KB

MD5
c498ae64b4971132bba676873978de1e

SHA1
92e4009cd776b6c8616d8bffade7668ef3cb3c27

SHA256
5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

SHA512
8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss5F.tmp\nsResize.dll

Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/3484-152-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-160-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-151-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-149-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-153-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-154-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-155-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-156-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-157-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-158-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-148-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-150-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-161-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-162-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-163-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-164-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-165-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-166-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-167-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-168-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-170-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-171-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-169-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download
memory/3484-172-0x0000000073B60000-0x0000000073B69000-memory.dmp

Filesize
36KB

Download