Analysis
-
max time kernel
167s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 21:17
General
-
Target
9bc3304f8e8f352647fa84435b037a6bdfe06d9897cc339536b496f39e98beb0.exe
-
Size
10.7MB
-
MD5
a734962038e6c57ebc89cec0cbe74705
-
SHA1
690db5bcac5732efb57cd523ae8c6197755b3a6d
-
SHA256
9bc3304f8e8f352647fa84435b037a6bdfe06d9897cc339536b496f39e98beb0
-
SHA512
2542d1d4d6286bb816d0084624ede82ee53f298022ffcee82536f32d4d52384b270422672b887641a9f7c8e72e1a22ffa32534e0f008b1e95e44aee3547a1a33
-
SSDEEP
196608:D/BgW+jY1zaGCwCwo3WIvSOHnJGCwL3caee5vYPaqGa/srL5QmuUVPIOVmYZZQxU:Dpg24GCB3VHJGPDIavY4rFQSV/YlxVUN
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bc3304f8e8f352647fa84435b037a6bdfe06d9897cc339536b496f39e98beb0.exe"C:\Users\Admin\AppData\Local\Temp\9bc3304f8e8f352647fa84435b037a6bdfe06d9897cc339536b496f39e98beb0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\GPInstall.exe"C:\Windows\GPInstall.exe" "/SOURCE=C:\Users\Admin\AppData\Local\Temp\9bc3304f8e8f352647fa84435b037a6bdfe06d9897cc339536b496f39e98beb0.exe" "/DATA=C:\Users\Admin\AppData\Local\Temp\GPIC7A5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD57795886204927b42d4806cd802c267f2
SHA1d120b25b4649ac84e6b23e5d3fb603c743ef5fae
SHA2560c92e7c9759d9dc7a2c44bea2cbdca862c3b2ec19224e2cedf67188637a4d7d0
SHA5123812b81d87a20b838643269241dc312571ab20a3675f24bbc41f6ee65e0d126b2e32b4561d19ba27cdb7a679de4d101a3828b8550c4368444ae5c8d275f8bfe9
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
Filesize
754KB
MD5632ee49303df4e83308dc350f07acc90
SHA18b2cfe2577f1530111def34f59b533c297b914e4
SHA256ffa400dd5a9f381f219eedee47958770281ae95dcb4bb61339f73148539b5bba
SHA512afc4776539b11c640874a57e9517a4314616ee37f4d63f2ddeab19b8cc11e75240845af2e5ec36518ee7a409449af42dfdf49daed02313a1b3d19004a5e27e68
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
Filesize
460KB
-
-
Filesize
460KB
-
Filesize
116KB
-
Filesize
460KB
-
Filesize
8KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
460KB
-
Filesize
116KB