277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747

Analysis

max time kernel
146s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe
Size

937KB
MD5

83e6a4db564587028ab90096c0db37f4
SHA1

b4589ddf0d5c85677cac0795046d6af6f3179047
SHA256

277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747
SHA512

c9dcd59172f10348cc15b69dfe52ba6ff15d72bb4ab304ed164fc90e24688bab9a66455b72ad4cfd9b6eac3dd7b7fd5f8604bfde76ddc59c7e0b59ef912e9ce3
SSDEEP

24576:f23v+KzMD2A92PmKuTrW0AynWmtaUAt2nsFH8n39YxO2vsA:fpCAk5uHp9WD8oHSYQ2n

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\cbkB19.tmp	acprotect

Loads dropped DLL 2 IoCs

Processes:

277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe

pid	process
1092	277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe
1092	277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe

description	ioc	process
File opened (read-only)	\??\A:	277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe
File opened (read-only)	\??\B:	277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe

pid process

1092 277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe

C:\Users\Admin\AppData\Local\Temp\277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe
"C:\Users\Admin\AppData\Local\Temp\277a169fd06325f92321cc41fc3dabe4cee2d6b315f2bd0ec374f9f8ea0b3747.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cbkB19.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll

Filesize
500KB

MD5
2c93e8c9854cf42d621b2eb05c420cb4

SHA1
515e440f64a141d6f82bb8a81a2f82a826f0ffc2

SHA256
27170b52d5d6887824aef79ca546c9eca7755cf2eb632b1129302028c99aa7aa

SHA512
420e45169a352d0575a9d1b1ab341b51ecf2be537ccf404d6ca02f24e0084591c5b200ed70842eec9eff7188c8d893c9303d283e8d4c131d96d05f3dab8df40a

Download Submit
memory/1092-56-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1092-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1092-58-0x0000000000420000-0x0000000000493000-memory.dmp

Filesize
460KB

Download
memory/1092-59-0x0000000000420000-0x0000000000493000-memory.dmp

Filesize
460KB

Download