Analysis
-
max time kernel
130s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:16
Static task
static1
Behavioral task
behavioral1
Sample
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe
Resource
win10v2004-20221111-en
General
-
Target
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe
-
Size
1.1MB
-
MD5
2437bf8036e97ea58743cffc2f4fef8a
-
SHA1
381a3d5c23e2e445b065f05f439dabc2b7ca2f79
-
SHA256
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d
-
SHA512
551062a07580667f38dae05af378c7466453971b934f99c57c9315f5b3c330ba4b6ffd4d8d19800a51e650c4f93f25637d359b43cc76e1f80060f02bb5025c17
-
SSDEEP
24576:uis6goUNOwmE1KKntt73n2k27OvmvowkWMEEp86ECJn20wIgdw:LgLLhvttp2ZvXMppRA0wPdw
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nqkA48A.tmp acprotect C:\Users\Admin\AppData\Local\Temp\nqkA48A.tmp acprotect \Users\Admin\AppData\Local\Temp\nqkA48A.tmp acprotect -
Executes dropped EXE 1 IoCs
Processes:
is-HKF3H.tmppid process 1780 is-HKF3H.tmp -
Loads dropped DLL 5 IoCs
Processes:
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exeis-HKF3H.tmppid process 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe 1780 is-HKF3H.tmp 1780 is-HKF3H.tmp 1780 is-HKF3H.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
is-HKF3H.tmppid process 1780 is-HKF3H.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exepid process 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exedescription pid process target process PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp PID 2040 wrote to memory of 1780 2040 c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe is-HKF3H.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe"C:\Users\Admin\AppData\Local\Temp\c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EUHTN.tmp\is-HKF3H.tmp"C:\Users\Admin\AppData\Local\Temp\is-EUHTN.tmp\is-HKF3H.tmp" /SL4 $7012C "C:\Users\Admin\AppData\Local\Temp\c8b66d0b9f801b285562718a592c8091df121dc97b055093ce25dc0ff7c6704d.exe" 753343 517122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-EUHTN.tmp\is-HKF3H.tmpFilesize
616KB
MD50e5fd0fc130e2380b08edca8f822f382
SHA1e36aacde42ac8f297d3bffb379c021639ef4c06a
SHA256d3f6c4e1b8e6d11661d4bdf79b438382bb5951e7a42cedbcac3ebbe88012373c
SHA512efaabebb37413eb2a689be4070827dbeb9ba8f88f6a90a3ed33225c68eb02e43e4760dcfdf3e59eba589db0519e9ac447035ef9b3822c0414ccebdc79a5bde37
-
C:\Users\Admin\AppData\Local\Temp\is-EUHTN.tmp\is-HKF3H.tmpFilesize
616KB
MD50e5fd0fc130e2380b08edca8f822f382
SHA1e36aacde42ac8f297d3bffb379c021639ef4c06a
SHA256d3f6c4e1b8e6d11661d4bdf79b438382bb5951e7a42cedbcac3ebbe88012373c
SHA512efaabebb37413eb2a689be4070827dbeb9ba8f88f6a90a3ed33225c68eb02e43e4760dcfdf3e59eba589db0519e9ac447035ef9b3822c0414ccebdc79a5bde37
-
C:\Users\Admin\AppData\Local\Temp\nqkA48A.tmpFilesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
\Users\Admin\AppData\Local\Temp\is-278QJ.tmp\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-278QJ.tmp\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-EUHTN.tmp\is-HKF3H.tmpFilesize
616KB
MD50e5fd0fc130e2380b08edca8f822f382
SHA1e36aacde42ac8f297d3bffb379c021639ef4c06a
SHA256d3f6c4e1b8e6d11661d4bdf79b438382bb5951e7a42cedbcac3ebbe88012373c
SHA512efaabebb37413eb2a689be4070827dbeb9ba8f88f6a90a3ed33225c68eb02e43e4760dcfdf3e59eba589db0519e9ac447035ef9b3822c0414ccebdc79a5bde37
-
\Users\Admin\AppData\Local\Temp\nqkA48A.tmpFilesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
\Users\Admin\AppData\Local\Temp\nqkA48A.tmpFilesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
memory/1780-60-0x0000000000000000-mapping.dmp
-
memory/1780-73-0x00000000004B0000-0x0000000000523000-memory.dmpFilesize
460KB
-
memory/1780-76-0x00000000004B0000-0x0000000000523000-memory.dmpFilesize
460KB
-
memory/2040-54-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2040-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2040-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/2040-68-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB
-
memory/2040-69-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB
-
memory/2040-70-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB
-
memory/2040-72-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2040-71-0x0000000000420000-0x0000000000493000-memory.dmpFilesize
460KB
-
memory/2040-74-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB
-
memory/2040-75-0x0000000000020000-0x0000000000034000-memory.dmpFilesize
80KB