Analysis
-
max time kernel
48s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:19
Behavioral task
behavioral1
Sample
1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe
-
Size
26KB
-
MD5
d297a6085cdcf0610e263e2f73d6b6ba
-
SHA1
c200c715e1dfdfcafb50ba5347c1093ae28f0ff2
-
SHA256
1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c
-
SHA512
25fe2f8fe12bfbff563c2ea1e8fefb42cf84283ad28143cc0df70e7b8e0f3209aa613ebb78612cfc9cf24874ff6c1323df8b786f90e02062f42806c1297554bd
-
SSDEEP
768:lMPn5bGKBZ8K0wUbtuzM3hQPLEHf/3l8J:k1BZ8K0wUbcPLMfN8J
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000012308-55.dat acprotect -
resource yara_rule behavioral1/files/0x000a000000012308-55.dat upx behavioral1/memory/616-57-0x0000000010000000-0x0000000010012000-memory.dmp upx behavioral1/memory/616-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/616-59-0x0000000010000000-0x0000000010012000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 932 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\08223B03.dll 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fOnts\eCgMhGRkPUcdutd0.Ttf 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}\InprocServer32 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}\InprocServer32\ = "C:\\Windows\\SysWow64\\08223B03.dll" 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}\InprocServer32\ThreadingModel = "Apartment" 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}\InprocServer32 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E} 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe Token: SeDebugPrivilege 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 616 wrote to memory of 932 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 28 PID 616 wrote to memory of 932 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 28 PID 616 wrote to memory of 932 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 28 PID 616 wrote to memory of 932 616 1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe"C:\Users\Admin\AppData\Local\Temp\1f57b5b5a69ac0decc867c0d548bfa072b5a089205c67da201c9fc57dc0d4b0c.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1F57B5~1.EXE >> NUL2⤵
- Deletes itself
PID:932
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD56dea1b9eebba50fc7006a0b1ea6e2de8
SHA1bf91304498f2dfcc080385d7ec36efde439f0b8f
SHA256f626229ce8a3085180b82d0056d84e2df2e3886a49847cfe140035798558e197
SHA512ce0e742f224230a5b17c439d867f89b75661e6f04cd401dad508015c368e0f36f5ac13d352fe2842301e01ac5b183dbf4ae438e5816fdc65ab7e26e20a66d983