Analysis
-
max time kernel
298s -
max time network
366s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 15:53
Static task
static1
Behavioral task
behavioral1
Sample
8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe
Resource
win10v2004-20221111-en
General
-
Target
8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe
-
Size
5.4MB
-
MD5
d22548ecbeff29b328d2fca7e1a99e4a
-
SHA1
48d58fafb43f56516ce8f9ee72a6c39fe840d138
-
SHA256
8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00
-
SHA512
44b9d577de7428ce3a8c68a00f5231b672075dbb8c7da610a1b5fd65917fbfae624e9a091057743048307cc89cb0ec5d6f2787c0c7a83831f5a806e7e6355b7c
-
SSDEEP
98304:U1k8VO82XHfzqEKn7QSNak6VyhDLYnWO2XJ4tpx69BIMYMqjO97vbNnLlt:G2XHfOEKsniMn92Xitpx6DzYMSCvbNh
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000022e01-140.dat acprotect -
resource yara_rule behavioral2/files/0x0009000000022e01-140.dat upx behavioral2/memory/4336-141-0x00000000736D0000-0x00000000736DA000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 4376 RunDll32.exe 1988 RunDll32.exe 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 4376 RunDll32.exe 4376 RunDll32.exe 4376 RunDll32.exe 4376 RunDll32.exe 4376 RunDll32.exe 4376 RunDll32.exe 1988 RunDll32.exe 1988 RunDll32.exe 4376 RunDll32.exe 4376 RunDll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4376 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 85 PID 4336 wrote to memory of 4376 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 85 PID 4336 wrote to memory of 4376 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 85 PID 4336 wrote to memory of 1988 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 86 PID 4336 wrote to memory of 1988 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 86 PID 4336 wrote to memory of 1988 4336 8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe"C:\Users\Admin\AppData\Local\Temp\8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe "C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll",_OCPID974OpenCandy2@16 4336,031BF50FF97D4E3DA2FD28E470AF5337,61298CC20CF3429487173E286B214AA0,F94F5928F1D04352A54588E596E542802⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
-
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe "C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll",_OCPID974OpenCandy2@16 4336,9949F8CD01214D4AB585A784B9C0F90B,A4BA3F2B1B3C47868F470294608D1593,F94F5928F1D04352A54588E596E542802⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5bcbacda49fb2c44fee595cbc82036242
SHA1a33356996c7b3e032693bb373bbde2acf72cc469
SHA25677ecf5896f33bbc002f00dd4742c00a20981bbc618563e49f34ea8f740da890d
SHA51218c44cedb9b0fbd301ad9cbe5ebafe66d16380090baa41697f3224a5086313c61420730e8a5050fa7de31e2f47dbd21259d6758cf84557e0c34b901a93c4ddc0
-
Filesize
848KB
MD59e4e850e12f2f4f869b2491dbbb17ceb
SHA1bd89581a89604b601c817ea680c2a224b46737f8
SHA2564d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6
SHA5129285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5
-
Filesize
848KB
MD59e4e850e12f2f4f869b2491dbbb17ceb
SHA1bd89581a89604b601c817ea680c2a224b46737f8
SHA2564d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6
SHA5129285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5
-
Filesize
848KB
MD59e4e850e12f2f4f869b2491dbbb17ceb
SHA1bd89581a89604b601c817ea680c2a224b46737f8
SHA2564d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6
SHA5129285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5
-
Filesize
848KB
MD59e4e850e12f2f4f869b2491dbbb17ceb
SHA1bd89581a89604b601c817ea680c2a224b46737f8
SHA2564d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6
SHA5129285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5292aa9f95a7f081625056c497078159a
SHA172076f3eb146ab7ea2b3dd0ef6a63c06f86d64f1
SHA25618f2b2f20c65a022a1c8aaf776b4c9be6c193b73c2079d9d65d56b802fcadfb5
SHA51287f83c3bbcfedd98364b5d0209f912e66c72d43eb887438ad9735c078e6d1f6ea12566a75f0b652602bbd9f0608ce7148dc1703821f2ab6b366f061b8a58d910