b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b

General

Target

b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
Size

353KB
MD5

482984489450e7e582492ebb6f8743e6
SHA1

82155522f5b61b90dd5700c2365f4d1b4125ec11
SHA256

b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
SHA512

be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
SSDEEP

6144:qK7hBDO7gNSXo551EgMOK/Vmju+MokGwiquFeoQ3z3T4Qmw:rTO7gNN556gcuu+MokvMevz38w

Score

9^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00140000000054ab-55.dat	acprotect
behavioral1/files/0x00080000000126c9-61.dat	acprotect
behavioral1/files/0x00140000000054ab-64.dat	acprotect
behavioral1/files/0x00140000000054ab-63.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
960	rcflye.exe

Deletes itself 1 IoCs

pid	Process
1292	WScript.exe

Loads dropped DLL 3 IoCs

pid	Process
1708	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
960	rcflye.exe
1292	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\rcflye.exe"	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rcflye.exe	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
File opened for modification	C:\Windows\SysWOW64\rcflye.exe	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1708	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
960	rcflye.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1292	1708	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe	29
PID 1708 wrote to memory of 1292	1708	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe	29
PID 1708 wrote to memory of 1292	1708	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe	29
PID 1708 wrote to memory of 1292	1708	b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe	29

C:\Users\Admin\AppData\Local\Temp\b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
"C:\Users\Admin\AppData\Local\Temp\b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\5227.vbs"
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:1292

C:\Windows\SysWOW64\rcflye.exe
C:\Windows\SysWOW64\rcflye.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\5227.vbs

Filesize
500B

MD5
dcfde6e1d6f24353f610ac599052525c

SHA1
cb3c45661f9d709535b33d5ad173fb3b3dfab389

SHA256
2181025e2a0c0bee674408ea13e6bf3cf862203662d72f4d0f70f08da5d1dc30

SHA512
5943f3464793e48a346ddc1fc4aeee62d0beb58567d57ad4ce07d695d00a98eabe02a986440eb04c0b182e2799721de533143f0fb72646326b01e8c9e1ef0e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\qgk45A9.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\SysWOW64\rcflye.exe

Filesize
353KB

MD5
482984489450e7e582492ebb6f8743e6

SHA1
82155522f5b61b90dd5700c2365f4d1b4125ec11

SHA256
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b

SHA512
be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01

Download Submit
C:\Windows\SysWOW64\rcflye.exe

Filesize
353KB

MD5
482984489450e7e582492ebb6f8743e6

SHA1
82155522f5b61b90dd5700c2365f4d1b4125ec11

SHA256
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b

SHA512
be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01

Download Submit
\Users\Admin\AppData\Local\Temp\qgk45A9.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\qgk45A9.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\Temp\plk6E9C.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/960-66-0x0000000001D80000-0x0000000001DF3000-memory.dmp

Filesize
460KB

Download
memory/960-65-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/960-71-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1292-68-0x0000000000460000-0x00000000004D3000-memory.dmp

Filesize
460KB

Download
memory/1708-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1708-57-0x0000000000300000-0x0000000000373000-memory.dmp

Filesize
460KB

Download
memory/1708-67-0x0000000000300000-0x0000000000373000-memory.dmp

Filesize
460KB

Download
memory/1708-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing