76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0

Analysis

max time kernel
10s
max time network
48s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
Size

129KB
MD5

ed9b2c7c8ced37dd54e24bcb8cc2881b
SHA1

71a54ecbc2819e9d548c7d94d32ee8f4b1709e7e
SHA256

76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0
SHA512

0e30e5d5bf6e0365038a9a9e0cca0a95200c78743b51f6602949e56d4761a1eabb54fb4f0d150b43534e690eaba7c9e01068e80e0682c9fd1f76af77f9b1593b
SSDEEP

3072:d5BuYAVrgUCPnN45zoZwGtFnEQax4s9ThFEYv:d50gUClEoR8PFdv

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122fb-59.dat	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122fb-59.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
1108	76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
1108	76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
1108	76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
1108	76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
1108	76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
1108	76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe
"C:\Users\Admin\AppData\Local\Temp\76ef80004be8ee8341bc4d12106f9939f5778953480e334b35865d53dba18bd0.exe"
1⤵
- Loads dropped DLL
PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsxA92C.tmp\NSISArray.dll

Filesize
20KB

MD5
5ae0c62802120e2fa971959795581daf

SHA1
e0c2d66ba75b41f8e22ff31c90986e572735429f

SHA256
a8c486730810c55c337c7d6863243fad25c212b4d11ceeceb420c4b2c131a605

SHA512
e09b14c1eef4c3962f18307df4abf4fbb62710dbf3cde80346069861b4db63e72b0441e0136921290725632f6c21b3916920e928f4df63b3f5c0e78b8e750101

Download Submit
\Users\Admin\AppData\Local\Temp\nsxA92C.tmp\NSISdl.dll

Filesize
15KB

MD5
7caaf58a526da33c24cbe122e7839693

SHA1
7687112cb6593947226f8a8319d6e2d0cdef3b11

SHA256
19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

SHA512
aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

Download Submit
\Users\Admin\AppData\Local\Temp\nsxA92C.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsxA92C.tmp\inetc.dll

Filesize
27KB

MD5
bd30dd24c0084fd883949bdbdca225e2

SHA1
fddf52a9d22a6e614e202a0c55deb5752f4595eb

SHA256
e554d904b4903c74035772b4b20cb7cc508f7d27bfee79f424f29ad31d4caf59

SHA512
4d24c9160caaa8f3b0ca5ae13a8fc64d9c0fe722c274f63aa4c2d7379f8e4aa5bcdad45e49b62ad928d7bb759657e4a4915327fab0728ffd20dc838a4b6811e5

Download Submit
\Users\Admin\AppData\Local\Temp\nsxA92C.tmp\newadvsplash.dll

Filesize
8KB

MD5
55a723e125afbc9b3a41d46f41749068

SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

Download Submit
\Users\Admin\AppData\Local\Temp\nsxA92C.tmp\version.dll

Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
memory/1108-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1108-61-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download