Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 04:23

General

  • Target

    a0d1616ee4ad317af0e1b0e62dcc9057690a910b944b0a9bbd8b590b8628f745.exe

  • Size

    19.3MB

  • MD5

    64996794dc62b32d4b5b08d1ebdec1c0

  • SHA1

    29b65b8437424627953f7d9240589e08e721be79

  • SHA256

    a0d1616ee4ad317af0e1b0e62dcc9057690a910b944b0a9bbd8b590b8628f745

  • SHA512

    910c26148f9218e344b3b786aaa365bf182c18f4c4f052236392b536e253c1944cece2840d879730e8641c4ecf81e8f4293bcc74bbe2133ddd3549551ca1b114

  • SSDEEP

    393216:himdhqnnXe9bz7M98vv5vDOJfN0Cy2ugD7u/LbdUDo3oO2kO:himdhqnOBvvBOJfNHy2uM7uT5UiO

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0d1616ee4ad317af0e1b0e62dcc9057690a910b944b0a9bbd8b590b8628f745.exe
    "C:\Users\Admin\AppData\Local\Temp\a0d1616ee4ad317af0e1b0e62dcc9057690a910b944b0a9bbd8b590b8628f745.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\a0d1616ee4ad317af0e1b0e62dcc9057690a910b944b0a9bbd8b590b8628f745.exe
      "C:\Users\Admin\AppData\Local\Temp\a0d1616ee4ad317af0e1b0e62dcc9057690a910b944b0a9bbd8b590b8628f745.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2476

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{4860CD93-9E5A-4A55-A44D-203A074F1E9A}.dll

    Filesize

    120KB

    MD5

    c9f333d1ff898672a34805f94a265329

    SHA1

    2deaac66698fb2e9b3868d23034c3211c508b739

    SHA256

    07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

    SHA512

    048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

  • C:\Users\Admin\AppData\Local\Temp\{4860CD93-9E5A-4A55-A44D-203A074F1E9A}.dll

    Filesize

    120KB

    MD5

    c9f333d1ff898672a34805f94a265329

    SHA1

    2deaac66698fb2e9b3868d23034c3211c508b739

    SHA256

    07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

    SHA512

    048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

  • memory/2476-132-0x0000000000000000-mapping.dmp

  • memory/2476-133-0x0000000000400000-0x000000000055D000-memory.dmp

    Filesize

    1.4MB

  • memory/2476-134-0x0000000000400000-0x000000000055D000-memory.dmp

    Filesize

    1.4MB

  • memory/2476-135-0x0000000000400000-0x000000000055D000-memory.dmp

    Filesize

    1.4MB

  • memory/2476-138-0x0000000005080000-0x00000000050DB000-memory.dmp

    Filesize

    364KB