add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff

Analysis

max time kernel
130s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff.exe
Size

2.0MB
MD5

b3c0d02d4ae190903d555c308a086976
SHA1

3f15751ee59452e8f44e35566a378168fca969a4
SHA256

add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff
SHA512

1a8d9240ccfa31d0ab42ca14463a070ff9469841294a3aa05968b839eaeb24914f04ddf02ce9abbf96ec3ded749699b43b61548239074806da9589bdc38d88aa
SSDEEP

49152:olbainSwsTMT1GVQBm5gChw0uMj55mmWhfsiAGuyiq2iB:olmPwlESTCK0rJWHubMB

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122f0-56.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1824	add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1824	add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff.exe

C:\Users\Admin\AppData\Local\Temp\add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff.exe
"C:\Users\Admin\AppData\Local\Temp\add43244a6238a20cc6366b7875e4273be1e081a9b1fbd1c210f2d5699fbdcff.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\djk6124.tmp

Filesize
172KB

MD5
fe763c2d71419352141c77c310e600d2

SHA1
6bb51ebcbde9fe5556a74319b49bea37d5542d5e

SHA256
7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

SHA512
147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

Download Submit
memory/1824-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1824-55-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/1824-57-0x0000000001C80000-0x0000000001CF3000-memory.dmp

Filesize
460KB

Download
memory/1824-58-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/1824-59-0x0000000001C80000-0x0000000001CF3000-memory.dmp

Filesize
460KB

Download