fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe
Size

893KB
MD5

0200f3b113ecb46192f4d2c2b392bc33
SHA1

0d1deced8c0117e994f35e17563c82d393b9fe3a
SHA256

fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa
SHA512

73ea9eb0196de02445881ad9e5670167047908db755f38ab017d33d46025a3333d935aebb1c0e28d33052dc43081aa7d2d46197ee593847c3d1eb5a40923bda9
SSDEEP

24576:7DKnxYaXJi2Y3MpbwnCvzb4cCmddTyVDbqbTuub:7DkYOMwwnMb4I7yVzub

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1932	fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1932	fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe

C:\Users\Admin\AppData\Local\Temp\fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe
"C:\Users\Admin\AppData\Local\Temp\fde3ff3a9bc3badc4973a563d74668d774e22db28b1ba9393db897a43f51f6fa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gjk5D3E.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
memory/1932-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1932-58-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1932-59-0x0000000001D00000-0x0000000001D74000-memory.dmp

Filesize
464KB

Download
memory/1932-60-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1932-61-0x0000000001D00000-0x0000000001D74000-memory.dmp

Filesize
464KB

Download