Overview

overview

9

Static

static

1

bd6230c3e1...66.exe

windows7-x64

9

bd6230c3e1...66.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 11:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bd6230c3e11bf4a248dddf36d251a09e062a09d7d8112bc194115b1bb9c39f66.exe
  • Size 23.5MB
  • Sample221129-ngsxvsdg53
  • SHA256 bd6230c3e11bf4a248dddf36d251a09e062a09d7d8112bc194115b1bb9c39f66
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd6230c3e11bf4a248dddf36d251a09e062a09d7d8112bc194115b1bb9c39f66.exe
    "C:\Users\Admin\AppData\Local\Temp\bd6230c3e11bf4a248dddf36d251a09e062a09d7d8112bc194115b1bb9c39f66.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1172
      2⤵
      • Program crash
      PID:4408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1200
      2⤵
      • Program crash
      PID:4028
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1760 -ip 1760
    1⤵
      PID:1604
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1760 -ip 1760
      1⤵
        PID:4340

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            K8Skin.dll
            • Path C:\Users\Admin\AppData\Local\Temp\776021284\K8Skin.dll
            • Size 376KB
            • SHA256 2f2f55967767478491d982c07d7197db914a3cf22d57b9ded917c1e9173f8431
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            K8Skin.dll
            • Path C:\Users\Admin\AppData\Local\Temp\776021284\K8Skin.dll
            • Size 376KB
            • SHA256 2f2f55967767478491d982c07d7197db914a3cf22d57b9ded917c1e9173f8431
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ButtonEvent.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\ButtonEvent.dll
            • Size 4KB
            • SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
            • MD5 SHA1 SHA512
            Submit Download

            ButtonEvent.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\ButtonEvent.dll
            • Size 4KB
            • SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
            • MD5 SHA1 SHA512
            Submit Download

            K8NsisExtend.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\K8NsisExtend.dll
            • Size 232KB
            • SHA256 c1ea3139cf606f73bc922fdedfb48624aab787661adf6159f86925a2150b06ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            K8NsisExtend.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\K8NsisExtend.dll
            • Size 232KB
            • SHA256 c1ea3139cf606f73bc922fdedfb48624aab787661adf6159f86925a2150b06ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NSISdl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\NSISdl.dll
            • Size 14KB
            • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NSISdl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\NSISdl.dll
            • Size 14KB
            • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NSISdl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\NSISdl.dll
            • Size 14KB
            • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NSISdl.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\NSISdl.dll
            • Size 14KB
            • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\System.dll
            • Size 11KB
            • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            nsRandom.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\nsRandom.dll
            • Size 21KB
            • SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            nsRandom.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsm181E.tmp\nsRandom.dll
            • Size 21KB
            • SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1760-138-0x00000000023B0000-0x0000000002411000-memory.dmp
            Download

            memory/1760-146-0x00000000030C1000-0x00000000030C4000-memory.dmp
            Download

            memory/1760-142-0x00000000031E0000-0x000000000321E000-memory.dmp
            Download

            memory/1760-139-0x00000000023B0000-0x00000000023C2000-memory.dmp
            Download

            memory/1760-137-0x00000000023B1000-0x00000000023F8000-memory.dmp
            Download

            memory/1760-154-0x0000000003BE1000-0x0000000003BE3000-memory.dmp
            Download