Analysis
-
max time kernel
29s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 11:07
Behavioral task
behavioral1
Sample
afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe
-
Size
21KB
-
MD5
094e336d0e66d2664504a1940426e685
-
SHA1
aab0aa8f2811af218c92d7bf4f80f844898d606d
-
SHA256
afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c
-
SHA512
ded214a5d4933a596457dd103f328e72843cb46afe6ad843165475c38a18ef865f0f39979f2da7552ea2590dbdadab6e1d319ea24cc0ce2e0e28be2fe0b5d98c
-
SSDEEP
384:0luHHPs2ilHJxk7AsRZXLcvWm0Mt4tcguoQFndsCDwfw+XLU:yun3ilpSbXLc1tJguHFdLwXI
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00090000000133ec-55.dat acprotect -
resource yara_rule behavioral1/files/0x00090000000133ec-55.dat upx behavioral1/memory/1404-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1404-57-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/1404-59-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1496 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ufQCU5.dll afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\zZ5kDff9es3wZ9YZ.ttf afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C722AD57-35DA-4460-8353-328372F32AB2} afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C722AD57-35DA-4460-8353-328372F32AB2}\InprocServer32 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C722AD57-35DA-4460-8353-328372F32AB2}\InprocServer32\ = "C:\\Windows\\SysWow64\\ufQCU5.dll" afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C722AD57-35DA-4460-8353-328372F32AB2}\InprocServer32\ThreadingModel = "Apartment" afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{C722AD57-35DA-4460-8353-328372F32AB2}\InprocServer32 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe Token: SeDebugPrivilege 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1404 wrote to memory of 1496 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 28 PID 1404 wrote to memory of 1496 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 28 PID 1404 wrote to memory of 1496 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 28 PID 1404 wrote to memory of 1496 1404 afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe"C:\Users\Admin\AppData\Local\Temp\afb78b3c90ed080760346fefe00ecca6e6f8bdfd49c23f4cba863a3b9c0f6e4c.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AFB78B~1.EXE >> NUL2⤵
- Deletes itself
PID:1496
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5b80468aae36c20a6d43e343441f48ec9
SHA1ab43507cb8e1d07af8dc6eec59aff93cee204a47
SHA25684cf3f8d50b896f20bcc1e9d110cfa50012173782e0fa02db5f31a524e04735c
SHA512b943b6205ae09966c592b6c2fb73977df95c2f8730b2efdc959e2e300101ae38e80e5fb048275333a6a32842a02b521e28b5700f4ecc42c91d93a35398d897a0