ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7

Analysis

max time kernel
177s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe
Size

2.4MB
MD5

b7be9a50e7b66efa676d62da701a512c
SHA1

0af97a85941727fee47044149e2ae67cf3bd5282
SHA256

ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7
SHA512

d7748d8bc36bb49a538db24d1a8879541edf23c4826285003bb536034a540651c68c726c9ebdb48b07b18204976788451c08db0a757ead826deff212e27499c4
SSDEEP

49152:fAj5LjkLV7UUYPgU3jZ24WKbaMcBk/618FfZhowMlef75zjj:fAjy1c4CjZdcj18ZZho09D

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\lji5F75.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\lji5F75.tmp	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1332-132-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/1332-136-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/1332-137-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe

pid	process
1332	ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe
1332	ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe

pid	process
1332	ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe
1332	ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe

C:\Users\Admin\AppData\Local\Temp\ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe
"C:\Users\Admin\AppData\Local\Temp\ac904c7be7b258f06eebb78d62b492f7f6aab233baeca57dfa6780185f7750c7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lji5F75.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lji5F75.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/1332-132-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1332-135-0x0000000002230000-0x00000000022A3000-memory.dmp

Filesize
460KB

Download
memory/1332-136-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1332-137-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1332-138-0x0000000002230000-0x00000000022A3000-memory.dmp

Filesize
460KB

Download