8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36

General

Target

8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
Size

87KB
MD5

9d6da546d949d2739c95ece43ac4d27a
SHA1

f76e78ac4cbf869173cbcbd824d69c65b9a8f083
SHA256

8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36
SHA512

d50166d74e5794dd0e010e35dd458e29aa32cb44a4ced6c33b79ba818591f32338d367356fc5bd7ec42116e14cdc4c0a2bd46e200184984404577bc7ae3d294b
SSDEEP

1536:8g+3oThuKr+Dd/oR+tbOihf2tAv4pT9IOn42fCWoCnw1DPsBSAMHxia:8J2EKrcd/Ptyihf26v4TIOnTfd4DuPwM

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000022e13-133.dat	acprotect

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\ahnsvr.sys	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\SysWOW64\drivers\ntfsny.sys	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ntfsny.sys	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\SysWOW64\drivers\ahnsvr.sys	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4944-132-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/files/0x000a000000022e13-133.dat	upx
behavioral2/memory/4944-134-0x0000000010000000-0x0000000010037000-memory.dmp	upx
behavioral2/memory/4944-135-0x0000000010000000-0x0000000010037000-memory.dmp	upx
behavioral2/memory/4944-137-0x0000000010000000-0x0000000010037000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

Loads dropped DLL 1 IoCs

pid	Process
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\midisappe.dll	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\windowswalls.bmp	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\windowswalls.bmp	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\tasks\midisappe.dat	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File opened for modification	C:\Windows\tasks\midisappe.dat	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\midisappe.dll	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\tasks\ntfsny.dat	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\tasks\ahnsvr.dat	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
File created	C:\Windows\dnstmp.dll	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
Token: SeDebugPrivilege	4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 780	4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe	44
PID 4944 wrote to memory of 2676	4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe	83
PID 4944 wrote to memory of 2676	4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe	83
PID 4944 wrote to memory of 2676	4944	8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe	83

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:780
- C:\Users\Admin\AppData\Local\Temp\8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe
  "C:\Users\Admin\AppData\Local\Temp\8a9aaf7307755c1bd535b997dd1df51fd6de6e7fbe685f7b2c30695544264f36.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dele576f73.bat" "
    3⤵
    PID:2676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dele576f73.bat

Filesize
307B

MD5
fba32f19af18d72181c71d2081938498

SHA1
3fb182ae867f39cc779b23781cbff4ab538e322d

SHA256
d27acd6600bc7fbdf3c361c3233a9853e7f236f9294ac968452f1d46995909f4

SHA512
43e672eca21aa06320ab3499419cf6eb06632f72af8c1bb2b18f55034d07818112493243f7879e1668c5a4ccc053d18b3e5804b59f99c695b7cef853c744c734

Download Submit
C:\Windows\dnstmp.dll

Filesize
65KB

MD5
c4bdad5e3658759ce9745ff563c7b611

SHA1
39cae63dcfbced4aae85cdf2e486db481789421a

SHA256
ba486de6f70a6256155c0120ad2fe1da144afdc22e7608194bfd0d3059b71fb4

SHA512
dc2e3f2e6d8142f84fe3886588255f3471b0ca6e097704fbb8a9ffe2c0f89cca689ead00f4019db354e756f70f58ac74789285e592059a1dde26e8c65d199b8f

Download Submit
memory/4944-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4944-134-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4944-135-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4944-137-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing