Analysis

  • max time kernel
    298s
  • max time network
    366s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 15:53

General

  • Target

    8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe

  • Size

    5.4MB

  • MD5

    d22548ecbeff29b328d2fca7e1a99e4a

  • SHA1

    48d58fafb43f56516ce8f9ee72a6c39fe840d138

  • SHA256

    8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00

  • SHA512

    44b9d577de7428ce3a8c68a00f5231b672075dbb8c7da610a1b5fd65917fbfae624e9a091057743048307cc89cb0ec5d6f2787c0c7a83831f5a806e7e6355b7c

  • SSDEEP

    98304:U1k8VO82XHfzqEKn7QSNak6VyhDLYnWO2XJ4tpx69BIMYMqjO97vbNnLlt:G2XHfOEKsniMn92Xitpx6DzYMSCvbNh

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe
    "C:\Users\Admin\AppData\Local\Temp\8df863992923692a1668a4d38202c0a8ba63fbb758b9f594ed5485003048bc00.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Windows\SysWOW64\RunDll32.exe
      RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll",_OCPID974OpenCandy2@16 4336,031BF50FF97D4E3DA2FD28E470AF5337,61298CC20CF3429487173E286B214AA0,F94F5928F1D04352A54588E596E54280
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4376
    • C:\Windows\SysWOW64\RunDll32.exe
      RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll",_OCPID974OpenCandy2@16 4336,9949F8CD01214D4AB585A784B9C0F90B,A4BA3F2B1B3C47868F470294608D1593,F94F5928F1D04352A54588E596E54280
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\InstallerStuff.dll

    Filesize

    115KB

    MD5

    bcbacda49fb2c44fee595cbc82036242

    SHA1

    a33356996c7b3e032693bb373bbde2acf72cc469

    SHA256

    77ecf5896f33bbc002f00dd4742c00a20981bbc618563e49f34ea8f740da890d

    SHA512

    18c44cedb9b0fbd301ad9cbe5ebafe66d16380090baa41697f3224a5086313c61420730e8a5050fa7de31e2f47dbd21259d6758cf84557e0c34b901a93c4ddc0

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll

    Filesize

    848KB

    MD5

    9e4e850e12f2f4f869b2491dbbb17ceb

    SHA1

    bd89581a89604b601c817ea680c2a224b46737f8

    SHA256

    4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6

    SHA512

    9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll

    Filesize

    848KB

    MD5

    9e4e850e12f2f4f869b2491dbbb17ceb

    SHA1

    bd89581a89604b601c817ea680c2a224b46737f8

    SHA256

    4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6

    SHA512

    9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll

    Filesize

    848KB

    MD5

    9e4e850e12f2f4f869b2491dbbb17ceb

    SHA1

    bd89581a89604b601c817ea680c2a224b46737f8

    SHA256

    4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6

    SHA512

    9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\OCSetupHlp.dll

    Filesize

    848KB

    MD5

    9e4e850e12f2f4f869b2491dbbb17ceb

    SHA1

    bd89581a89604b601c817ea680c2a224b46737f8

    SHA256

    4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6

    SHA512

    9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • C:\Users\Admin\AppData\Local\Temp\nsvF426.tmp\nsJSON.dll

    Filesize

    6KB

    MD5

    292aa9f95a7f081625056c497078159a

    SHA1

    72076f3eb146ab7ea2b3dd0ef6a63c06f86d64f1

    SHA256

    18f2b2f20c65a022a1c8aaf776b4c9be6c193b73c2079d9d65d56b802fcadfb5

    SHA512

    87f83c3bbcfedd98364b5d0209f912e66c72d43eb887438ad9735c078e6d1f6ea12566a75f0b652602bbd9f0608ce7148dc1703821f2ab6b366f061b8a58d910

  • memory/4336-141-0x00000000736D0000-0x00000000736DA000-memory.dmp

    Filesize

    40KB