59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe
Size

9.3MB
MD5

25abd21210f1fc420456bd8fa77c432d
SHA1

b0c39c2aebaaad5839d9f3a716a85b609d3c1cea
SHA256

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35
SHA512

337aeb30de6cbc3526fdf0c0c040c8a14b6718fc7be32e2e2c220db7811b45385dc320a44696ed172e35faa422b653b88a2eae8683395e9087382bf4f046e173
SSDEEP

196608:F2i5US3zVH4w18ut60aknBizd5DgOq7WMet1FH9VPaq:Fb573BH7180NaTDq7WRpL

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ndk2685.tmp	acprotect

Loads dropped DLL 1 IoCs

Processes:

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe

pid process

992 59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe

pid process

992 59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe

pid	process
992	59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe

pid	process
992	59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe

C:\Users\Admin\AppData\Local\Temp\59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe
"C:\Users\Admin\AppData\Local\Temp\59b524affeb3f96bdc8e65b77a647a864c18f39ac8feeaf50bc39aa8395d1c35.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:992

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ndk2685.tmp
Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/992-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x0000000000400000-0x0000000000F0F000-memory.dmp

Filesize
11.1MB

Download
memory/992-57-0x0000000000330000-0x00000000003A3000-memory.dmp

Filesize
460KB

Download
memory/992-58-0x0000000000330000-0x00000000003A3000-memory.dmp

Filesize
460KB

Download
memory/992-59-0x0000000000400000-0x0000000000F0F000-memory.dmp

Filesize
11.1MB

Download