d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8

Analysis

max time kernel
202s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
Size

13.5MB
MD5

fb58d05cae958fff426c8ca2f4694ca5
SHA1

0c7a92890d523da45bf42de083f27c486dd906d8
SHA256

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8
SHA512

d1cace6d24221208cae0a06a66012da0bd4a15d8858eba89f5648fd1fe4f308d2b2116534668aee3f11b6a602bbe5b9a086cdb6f67d77899f4d68c708caa3aef
SSDEEP

393216:sIQL6oMHOW5gZPkSX1VWCw0r1hXD0Q92ArZU0:spL62k01VZr3p9230

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\fni8B38.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\fni8B38.tmp	acprotect
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE_NSIS.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE.dll	acprotect

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE_NSIS.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE.dll	upx
behavioral2/memory/4044-142-0x0000000010000000-0x0000000010003000-memory.dmp	upx
behavioral2/memory/4044-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4044-144-0x0000000004BF0000-0x0000000004CCF000-memory.dmp	upx
behavioral2/memory/4044-151-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4044-152-0x0000000004BF0000-0x0000000004CCF000-memory.dmp	upx
behavioral2/memory/4044-154-0x0000000010000000-0x0000000010003000-memory.dmp	upx

Loads dropped DLL 10 IoCs

Processes:

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

pid	process
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

pid	process
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

pid	process
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
4044	d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe

C:\Users\Admin\AppData\Local\Temp\d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe
"C:\Users\Admin\AppData\Local\Temp\d2a80962ee7b45b24ba8a202d2a0c2c58af5fe2ba69f525b64564123af8f27c8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fni8B38.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\fni8B38.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\FindProcDLL.dll
Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE.dll
Filesize
268KB

MD5
90f6da1d1381c4f0d86946cf354561ed

SHA1
533622c87081586eb6f32957e4963a2647b6de1c

SHA256
fd135dfa66a30f99ed3184a5b81b8f2198a62609da8a730c6a7f16b28f8f3b27

SHA512
1980c8f837ff2bf533a5c5a547b28c318a9369642df98341a9caca628d9ebf19aceee94db3efed7ee07e93aed340f856dcfd8a9c7beeeaf4f3b6d538373ab15b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE.dll
Filesize
268KB

MD5
90f6da1d1381c4f0d86946cf354561ed

SHA1
533622c87081586eb6f32957e4963a2647b6de1c

SHA256
fd135dfa66a30f99ed3184a5b81b8f2198a62609da8a730c6a7f16b28f8f3b27

SHA512
1980c8f837ff2bf533a5c5a547b28c318a9369642df98341a9caca628d9ebf19aceee94db3efed7ee07e93aed340f856dcfd8a9c7beeeaf4f3b6d538373ab15b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\SkinSE_NSIS.dll
Filesize
17KB

MD5
fc03fe6204b70f4315539eba5a71860d

SHA1
8eaffe6fcca6ae460a26dfa36362753304ab0385

SHA256
ef00587e3999902f66fa89f8f7a2a9de6e85f12a2649c7ca8affe1c9d1531daf

SHA512
722481b0bd20d1a40169098ec90206c06bc87ee8f19af4995c44d6bf9afea57b0b4fc9b676646447412c25838302a474fda419dc7640466afe34145ee9b0be8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\System.dll
Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\System.dll
Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiB21E.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/4044-142-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/4044-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4044-144-0x0000000004BF0000-0x0000000004CCF000-memory.dmp

Filesize
892KB

Download
memory/4044-137-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4044-136-0x0000000002210000-0x0000000002283000-memory.dmp

Filesize
460KB

Download
memory/4044-147-0x0000000004D41000-0x0000000004D43000-memory.dmp

Filesize
8KB

Download
memory/4044-135-0x0000000002210000-0x0000000002283000-memory.dmp

Filesize
460KB

Download
memory/4044-150-0x0000000004D51000-0x0000000004D53000-memory.dmp

Filesize
8KB

Download
memory/4044-134-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4044-151-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4044-152-0x0000000004BF0000-0x0000000004CCF000-memory.dmp

Filesize
892KB

Download
memory/4044-153-0x0000000002210000-0x0000000002283000-memory.dmp

Filesize
460KB

Download
memory/4044-154-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download