Analysis
-
max time kernel
156s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 02:07
Behavioral task
behavioral1
Sample
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe
Resource
win10v2004-20220812-en
General
-
Target
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe
-
Size
1.2MB
-
MD5
b9858d5ebae5d5f54892eaf59d9bdce9
-
SHA1
01526e235304695c41b7ce7a3feccc2dd11d9217
-
SHA256
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef
-
SHA512
91369602370a9f57f63093de812b6db2f53d832bf000a0afc4bb0ee19cc2cf90a1d061e50359894227aa8b6673fe84b8dcd199159d67c4ddbc78026a1329179d
-
SSDEEP
24576:5XJrfiQ3yIetnF+Tje3KWCx30/oFoLXvm8LweJAa/OEs:5XJ2Q3CF13dCi/TGeCaGE
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\~B357.dll acprotect C:\Users\Admin\AppData\Local\Temp\~B357.dll acprotect -
Processes:
resource yara_rule behavioral2/memory/4512-132-0x0000000000400000-0x0000000000648000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\~B357.dll upx C:\Users\Admin\AppData\Local\Temp\~B357.dll upx behavioral2/memory/4512-136-0x0000000000400000-0x0000000000648000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 5080 regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\SafetyCenter = "C:\\Program Files (x86)\\SafetyCenter\\start.exe" 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2414A739-9651-441B-BC10-D773267CC19D} regsvr32.exe -
Drops file in Program Files directory 7 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exedescription ioc process File opened for modification C:\Program Files (x86)\SafetyCenter\protector.exe 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe File created C:\Program Files (x86)\SafetyCenter\start.exe 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe File created C:\Program Files (x86)\SafetyCenter\new.exe 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe File created C:\Program Files (x86)\SafetyCenter\uninstall.exe 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe File created C:\Program Files (x86)\SafetyCenter\sound.wav 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe File created C:\Program Files (x86)\SafetyCenter\main.ico 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe File created C:\Program Files (x86)\SafetyCenter\protector.exe 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 13 IoCs
Processes:
regsvr32.exe9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2414A739-9651-441B-BC10-D773267CC19D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2414A739-9651-441B-BC10-D773267CC19D}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2414A739-9651-441B-BC10-D773267CC19D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~B357.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593} 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\DefaultIcon 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\Shell 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\Shell\Open 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\DefaultIcon\ = "C:\\Program Files (x86)\\SafetyCenter\\main.ico" 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\Shell\Open\Command 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\ = "Safety Center" 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCA9B86C-91BC-11DE-B1CD-35C755D89593}\Shell\Open\Command\ = "C:\\Program Files (x86)\\SafetyCenter\\protector.exe" 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2414A739-9651-441B-BC10-D773267CC19D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2414A739-9651-441B-BC10-D773267CC19D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exepid process 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 772 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 772 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exepid process 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exepid process 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exepid process 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exedescription pid process target process PID 4512 wrote to memory of 5080 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe regsvr32.exe PID 4512 wrote to memory of 5080 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe regsvr32.exe PID 4512 wrote to memory of 5080 4512 9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe"C:\Users\Admin\AppData\Local\Temp\9c23d2c48bc5912869f2ccee1cf8798cb8b9f466996c96538546c7466ae710ef.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~B357.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x388 0x38c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~B357.dllFilesize
213KB
MD5d40c15aa49878c82f3cf7d0816d97020
SHA101678df7c5f0db00b40fc5ea2c571261c2327c1b
SHA25610310893c405d4f1d42de3e4b884de9e68f51294a81fb7d73f998853f604f369
SHA512db15b2ce7592f5ed6a3c2ead1badef95861369430911d79ae86259f9dfe529da6430137501a116a913b661298e21402b38a752720b5d264fc0e38f11027573ef
-
C:\Users\Admin\AppData\Local\Temp\~B357.dllFilesize
213KB
MD5d40c15aa49878c82f3cf7d0816d97020
SHA101678df7c5f0db00b40fc5ea2c571261c2327c1b
SHA25610310893c405d4f1d42de3e4b884de9e68f51294a81fb7d73f998853f604f369
SHA512db15b2ce7592f5ed6a3c2ead1badef95861369430911d79ae86259f9dfe529da6430137501a116a913b661298e21402b38a752720b5d264fc0e38f11027573ef
-
memory/4512-132-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/4512-136-0x0000000000400000-0x0000000000648000-memory.dmpFilesize
2.3MB
-
memory/5080-133-0x0000000000000000-mapping.dmp