Analysis
-
max time kernel
177s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
Resource
win10v2004-20220812-en
General
-
Target
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe
-
Size
353KB
-
MD5
482984489450e7e582492ebb6f8743e6
-
SHA1
82155522f5b61b90dd5700c2365f4d1b4125ec11
-
SHA256
b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
-
SHA512
be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
-
SSDEEP
6144:qK7hBDO7gNSXo551EgMOK/Vmju+MokGwiquFeoQ3z3T4Qmw:rTO7gNN556gcuu+MokvMevz38w
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00140000000054ab-55.dat acprotect behavioral1/files/0x00080000000126c9-61.dat acprotect behavioral1/files/0x00140000000054ab-64.dat acprotect behavioral1/files/0x00140000000054ab-63.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 960 rcflye.exe -
Deletes itself 1 IoCs
pid Process 1292 WScript.exe -
Loads dropped DLL 3 IoCs
pid Process 1708 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 960 rcflye.exe 1292 WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\rcflye.exe" b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\rcflye.exe b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe File opened for modification C:\Windows\SysWOW64\rcflye.exe b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1708 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 960 rcflye.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1292 1708 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 29 PID 1708 wrote to memory of 1292 1708 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 29 PID 1708 wrote to memory of 1292 1708 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 29 PID 1708 wrote to memory of 1292 1708 b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe"C:\Users\Admin\AppData\Local\Temp\b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\5227.vbs"2⤵
- Deletes itself
- Loads dropped DLL
PID:1292
-
-
C:\Windows\SysWOW64\rcflye.exeC:\Windows\SysWOW64\rcflye.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:960
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500B
MD5dcfde6e1d6f24353f610ac599052525c
SHA1cb3c45661f9d709535b33d5ad173fb3b3dfab389
SHA2562181025e2a0c0bee674408ea13e6bf3cf862203662d72f4d0f70f08da5d1dc30
SHA5125943f3464793e48a346ddc1fc4aeee62d0beb58567d57ad4ce07d695d00a98eabe02a986440eb04c0b182e2799721de533143f0fb72646326b01e8c9e1ef0e95
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
353KB
MD5482984489450e7e582492ebb6f8743e6
SHA182155522f5b61b90dd5700c2365f4d1b4125ec11
SHA256b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
SHA512be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
-
Filesize
353KB
MD5482984489450e7e582492ebb6f8743e6
SHA182155522f5b61b90dd5700c2365f4d1b4125ec11
SHA256b9adae655706a8faf20953c3abe5d9212aede0822a90bc9b69b4d9f1d352d83b
SHA512be01d761ece0d3b00634031be6773b5dfd543f5a0c427bf3b94645503bc5c98672db65c619e96fa16903e169e299352e176b5ec731fd2852494a7c88b874ee01
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9