Analysis
-
max time kernel
91s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:26
Static task
static1
Behavioral task
behavioral1
Sample
0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe
Resource
win7-20220812-en
General
-
Target
0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe
-
Size
644KB
-
MD5
c08106ff6c218bd1366d1da36533e4d9
-
SHA1
c3f510befc711283f10f6517d08214bb05a86246
-
SHA256
0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79
-
SHA512
360fc25154e2dd71857f2f98c0426bde5baa19fda0349a0447b8a1d8acdff3a203ad9981aa50742cc3b275f0c76336dbe76444bccabe9e0fece7f99e5bd6b726
-
SSDEEP
12288:VKCFG+pl1Hp7p4ZkuRt4Zh3UdOxouSdWE7uglrB/jmN7Trkfcn+zi:V3Xxp4Zkuf47kdtdZ7uC/jmlrDn+zi
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\versioninfo.dll acprotect C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\versioninfo.dll acprotect -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\versioninfo.dll upx C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\versioninfo.dll upx behavioral2/memory/3440-155-0x00000000033A0000-0x00000000033AC000-memory.dmp upx behavioral2/memory/3440-157-0x00000000033A0000-0x00000000033AC000-memory.dmp upx -
Loads dropped DLL 17 IoCs
Processes:
0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exepid process 1764 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 4296 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 3440 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe -
Processes:
0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exedescription pid process target process PID 1764 wrote to memory of 4296 1764 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe PID 1764 wrote to memory of 4296 1764 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe PID 1764 wrote to memory of 4296 1764 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe PID 4296 wrote to memory of 3440 4296 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe PID 4296 wrote to memory of 3440 4296 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe PID 4296 wrote to memory of 3440 4296 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe 0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe"C:\Users\Admin\AppData\Local\Temp\0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe"C:\Users\Admin\AppData\Local\Temp\0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe"C:\Users\Admin\AppData\Local\Temp\0b08d3df102b0b0adf7231e58461daa3a3c8948b1ec6d9130e9ad54d43236a79.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3440
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsi4F5A.tmp\LuaBridge.dllFilesize
62KB
MD54e08fe995ab74ba4d145ddb77ea095fc
SHA1e4bb337e40069c097e7abd566b7427b11fb124ee
SHA256ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17
SHA512b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\026e996a3a5897970b058ffb093a163a1d763649.dllFilesize
11KB
MD50a29e1b270ccea61aba7d7cdd10e0388
SHA176bf03361bcaef475ffb864bc1903c9bcaac7b44
SHA25667328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb
SHA512d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\1370ebd534807c69ad0db6461cbf3f3fd03c434f.dllFilesize
193KB
MD5e390287499549de31da007f7f0ae4d10
SHA1a8c6caebb151d60ea56f4c96a7194c0e5f076692
SHA256b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b
SHA5126c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dllFilesize
80KB
MD54bf7db111acfa7c28ad36606107b3322
SHA16f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA256bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
SHA5120a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dllFilesize
80KB
MD54bf7db111acfa7c28ad36606107b3322
SHA16f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA256bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
SHA5120a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\FloatingProgress.dllFilesize
25KB
MD50f26c6d34d3841e93145dd00d0175651
SHA157b068569d0eb2336503beed87589629ab2a6f1f
SHA2560cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
SHA51272785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\LuaBridge.dllFilesize
62KB
MD54e08fe995ab74ba4d145ddb77ea095fc
SHA1e4bb337e40069c097e7abd566b7427b11fb124ee
SHA256ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17
SHA512b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\LuaXml_lib.dllFilesize
11KB
MD57292b642bd958aeb7fd7cfd19e45b068
SHA119a800620d041634abae5b5d096cb0e87ce4c188
SHA25690f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\LuaXml_lib.dllFilesize
11KB
MD57292b642bd958aeb7fd7cfd19e45b068
SHA119a800620d041634abae5b5d096cb0e87ce4c188
SHA25690f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\System.dllFilesize
10KB
MD57e3c808299aa2c405dffa864471ddb7f
SHA1b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA25691c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
SHA512599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\UACInfo.dllFilesize
4KB
MD5d02a497be5f89c44827f142c4662f591
SHA138f83ccbac11de069df0e1cd79a6fdf7f006516c
SHA2566d29dfd24695535b5973d8261d93373603ceaae03ab97662fe1b3dcc47d18226
SHA51281c87f9d56a8ab7703a4effd3ba7b982b6765ecbdc0dbb1c595f549c4310a5db57dcdc38929eafe56983ea8cefc0b572c3faf82a4b62eb7c564b05550215f1c1
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\f40368059830399ce8189100003d317f2739d087.dllFilesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\f40368059830399ce8189100003d317f2739d087.dllFilesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\lua51.dllFilesize
255KB
MD5fceee0026aafd237afdb4aea4ecd3557
SHA13e10da57143599eae915a688178abada78b8d82b
SHA25685db1e17c0fad08d9732405e781cda1e1613ace31c540a6e559cd8777df2c62c
SHA5129c974918c8afec8d8a58fc1239f269544b9dfe867459bb61901462f56f71a3dd574d3b2263dd14b99ff8a23c8096c408be3620785fd4476b975a43b999f559f2
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\versioninfo.dllFilesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
-
C:\Users\Admin\AppData\Local\Temp\nsm57E6.tmp\versioninfo.dllFilesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
-
C:\Users\Admin\AppData\Local\Temp\nsq545C.tmp\LuaBridge.dllFilesize
62KB
MD54e08fe995ab74ba4d145ddb77ea095fc
SHA1e4bb337e40069c097e7abd566b7427b11fb124ee
SHA256ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17
SHA512b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f
-
memory/3440-145-0x0000000003330000-0x0000000003346000-memory.dmpFilesize
88KB
-
memory/3440-150-0x0000000003370000-0x000000000337E000-memory.dmpFilesize
56KB
-
memory/3440-142-0x0000000003321000-0x0000000003323000-memory.dmpFilesize
8KB
-
memory/3440-139-0x00000000745E0000-0x000000007463E000-memory.dmpFilesize
376KB
-
memory/3440-135-0x0000000000000000-mapping.dmp
-
memory/3440-155-0x00000000033A0000-0x00000000033AC000-memory.dmpFilesize
48KB
-
memory/3440-156-0x00000000745E0000-0x000000007463E000-memory.dmpFilesize
376KB
-
memory/3440-157-0x00000000033A0000-0x00000000033AC000-memory.dmpFilesize
48KB
-
memory/4296-133-0x0000000000000000-mapping.dmp