Analysis
-
max time kernel
173s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:46
Behavioral task
behavioral1
Sample
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
Resource
win10v2004-20220812-en
General
-
Target
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
-
Size
463KB
-
MD5
7418b76bbceb8bff0508e5ab40e397c4
-
SHA1
8b19e4edd153579dc6b35e02d31460d466a803e9
-
SHA256
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8
-
SHA512
45e15dc27bc92898bf93e94be81d421e6323b5eb54acb6a41d4475aaba80b83f533f5fc2789da0e36026f9b2f6e87348022eda8d4e687b9d5aa7fc3481ed66d0
-
SSDEEP
12288:fQMSdD5Pc4MsRqOJIIEJm92ANrjczcy2MT/YmTANSqit14F3SLzJEK8:fQMSdDaw0gZEJs2QC/TwYBqi34FKm
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\hideprocess.dll acprotect -
Processes:
resource yara_rule C:\Windows\SysWOW64\hideprocess.dll upx -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/896-58-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/896-57-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/896-56-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/896-60-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/1496-62-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/1496-63-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/1496-64-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/1496-66-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe behavioral1/memory/1496-67-0x00000000009D0000-0x0000000000AC8000-memory.dmp autoit_exe -
Drops file in System32 directory 3 IoCs
Processes:
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exedescription ioc process File created C:\Windows\SysWOW64\hideprocess.dll 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe File opened for modification C:\Windows\SysWOW64\hideprocess.dll 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe File opened for modification C:\Windows\SysWOW64\hideprocess.dll 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exepid process 1496 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe 1496 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exedescription pid process target process PID 896 wrote to memory of 1496 896 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe PID 896 wrote to memory of 1496 896 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe PID 896 wrote to memory of 1496 896 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe PID 896 wrote to memory of 1496 896 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe 23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe"C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe"C:\Users\Admin\AppData\Local\Temp\23dccfd07357161f71ed3ff1f15af11e4fa674d62a4a83001f95af600a7661a8.exe" /ErrorStdOut2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1496
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\hideprocess.dllFilesize
21KB
MD59858f738d68d5d0f055ba3d879348a5c
SHA18723520ff149161d0ebc1e8ce34efcae90a0a37b
SHA256f2439030d186ba9f5ec6c3d484f3436ee2a2cc889a077a9c15a7650690498981
SHA51261167a4ba5803aa8b96e75fcecdb19161a09e32fd01fd828ddd92e8e6c61c27d0be28ea00123d72b0562eafdc5440ae26be672a45276faa6a048ea813fdb8a39
-
memory/896-60-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/896-58-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/896-57-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/896-56-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/896-54-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/896-55-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1496-59-0x0000000000000000-mapping.dmp
-
memory/1496-62-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/1496-63-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/1496-64-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/1496-66-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB
-
memory/1496-67-0x00000000009D0000-0x0000000000AC8000-memory.dmpFilesize
992KB