3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991

Analysis

max time kernel
224s
max time network
259s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
Size

101KB
MD5

2dec8d4e21ff03dbba7c1eaf85123844
SHA1

e3088c6140192b7c059c000101004b1990bd076e
SHA256

3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991
SHA512

e2deea3e6ddf16f3982760549f296b3a6694dfdcede37d421bbf773f4a6904e391a42ff3c28d762afe9b29eb5d186602a6bd8ad36c6ebf1f90183d2e0df004e5
SSDEEP

1536:+4UHxpN/MUXsLTvCj0DBXJaOTtjK9KfPQODLpHU2bTOTige4n8Nqoi/Q68mghU:+4URpNUUX6z/DBXJf4mPQ+e2sirM

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 17 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
behavioral1/memory/560-57-0x00000000744B0000-0x00000000744B9000-memory.dmp	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	acprotect
behavioral1/memory/560-72-0x00000000744A0000-0x00000000744A9000-memory.dmp	acprotect

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
behavioral1/memory/560-57-0x00000000744B0000-0x00000000744B9000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll	upx
behavioral1/memory/560-72-0x00000000744A0000-0x00000000744A9000-memory.dmp	upx

Loads dropped DLL 17 IoCs

Processes:

3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe

pid	process
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
560	3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe
"C:\Users\Admin\AppData\Local\Temp\3f3fde6c9e3621837515e03a828fd255c1a9ba3182c2c71ad067b1c4c167d991.exe"
1⤵
- Loads dropped DLL
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nspD26E.tmp\InstallOptions.dll
Filesize
14KB

MD5
34466cab38abcbc09ffac768d526f896

SHA1
2684f5f6c2b005cba812fc8cc1157777554fa3a3

SHA256
8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c

SHA512
5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\inetc.dll
Filesize
20KB

MD5
c498ae64b4971132bba676873978de1e

SHA1
92e4009cd776b6c8616d8bffade7668ef3cb3c27

SHA256
5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8

SHA512
8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
\Users\Admin\AppData\Local\Temp\nspD26E.tmp\nsResize.dll
Filesize
4KB

MD5
aa849e7407cf349021812f62c001e097

SHA1
4cbb55b1d1dd95dcb7a36b5a44121ad4934539af

SHA256
29b0e5792679756a79d501e3a9b317971b08e876fac1c2476180d0ae83b77ba5

SHA512
4556baa49e8182d72e29e8d809635312142eb127039f5803ca0bf011b4359f0b584a670a3bd26a9969165a332cfa14a39abeaeae0b4d90519f91fdea755c54de

Download Submit
memory/560-74-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-84-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-73-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/560-75-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-76-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-77-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-78-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-79-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-80-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-81-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-57-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-83-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-72-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-85-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-86-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-87-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-88-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-89-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-90-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-91-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-92-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-93-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download
memory/560-94-0x00000000744A0000-0x00000000744A9000-memory.dmp

Filesize
36KB

Download
memory/560-95-0x00000000744B0000-0x00000000744B9000-memory.dmp

Filesize
36KB

Download