Analysis
-
max time kernel
187s -
max time network
240s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
05/12/2022, 19:21
General
-
Target
d6852bc8a49702bf20a180bc78fb924ca6957be04e27c8d06ccb3e502f866139.exe
-
Size
2.8MB
-
MD5
0d29508eb32c8da127df45067b3528fc
-
SHA1
cb487ece6d178cbb9322084cc1aa718093a190c3
-
SHA256
d6852bc8a49702bf20a180bc78fb924ca6957be04e27c8d06ccb3e502f866139
-
SHA512
140abd755aced5b36cd9454eb0d2adcd977d8ed8964cf6eee75d0f8658574e335c17c1a7b407dbcdb1228abbf5a5dd534d8eaaaa7b3d71da16408da7aa6fd906
-
SSDEEP
49152:djNSVc8KcbWiN/Aer/3lBVqt0jAdow+D8jx4ovApzzkX+WdmHq:djNSVKZiNRr/3HA0j9xDy4oIpfa+E
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 3 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 6 IoCs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6852bc8a49702bf20a180bc78fb924ca6957be04e27c8d06ccb3e502f866139.exe"C:\Users\Admin\AppData\Local\Temp\d6852bc8a49702bf20a180bc78fb924ca6957be04e27c8d06ccb3e502f866139.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Wupdate.exe"C:\Users\Admin\AppData\Local\Temp\Wupdate.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\AiR eLicenser Emulator Setup.exe"C:\Users\Admin\AppData\Local\Temp\AiR eLicenser Emulator Setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8IO5R.tmp\AiR eLicenser Emulator Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-8IO5R.tmp\AiR eLicenser Emulator Setup.tmp" /SL5="$E0066,1841672,318976,C:\Users\Admin\AppData\Local\Temp\AiR eLicenser Emulator Setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f0 0x4081⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5d1a96902cd6c40e14944ab352925a435
SHA1df8bec8cacb82d838c7a3ef49c6a81e4ca7aa68f
SHA25602d941dc43d3dac8e4ce1afbd45ffa072ecfcd7d15198664e5018bd0a7d417e1
SHA51298d5fa56ee50c945e9d598693c8e6c084c8408b00d3c6eb04e7ea4389ae53f58452895a6d9da1375a393967ab88ae8162a2577e64d8fee7b4f58bffa3e9d7662
-
Filesize
2.2MB
MD5d1a96902cd6c40e14944ab352925a435
SHA1df8bec8cacb82d838c7a3ef49c6a81e4ca7aa68f
SHA25602d941dc43d3dac8e4ce1afbd45ffa072ecfcd7d15198664e5018bd0a7d417e1
SHA51298d5fa56ee50c945e9d598693c8e6c084c8408b00d3c6eb04e7ea4389ae53f58452895a6d9da1375a393967ab88ae8162a2577e64d8fee7b4f58bffa3e9d7662
-
Filesize
429KB
MD58823cba803209cd3adecb5fd35ffe8b4
SHA1dafe2b701ef5edc4569097e2e9b4901f7c342d62
SHA256cfba58aea33645f1d947077542430c15f615bf3879cad68614b400a5ffcc6ea1
SHA512fb907a72f6bc068f905fc81bbcb4082b92e18fb3bf7fa6475e5f719b1f2836b877c8b5a029e0185d05dc260c942c1a31d0a27c16530364d749e599db0d673548
-
Filesize
429KB
MD58823cba803209cd3adecb5fd35ffe8b4
SHA1dafe2b701ef5edc4569097e2e9b4901f7c342d62
SHA256cfba58aea33645f1d947077542430c15f615bf3879cad68614b400a5ffcc6ea1
SHA512fb907a72f6bc068f905fc81bbcb4082b92e18fb3bf7fa6475e5f719b1f2836b877c8b5a029e0185d05dc260c942c1a31d0a27c16530364d749e599db0d673548
-
Filesize
928KB
MD53dcf654fdbe60c9cf1d633ccd9d6f3d7
SHA151ee8a461a27fb9b1940b0296ad02219ddf72a13
SHA25600001a2498d2a92e16579eff239175122d1c790a76b87804d4bbf51e4ce374af
SHA512dd81a4787d13a6d997fb8a0390771b28efd337c9209d3b2f1cb16503f73721e36aa55e4a8e7a2746b7a3312a24ba699fa216b461de5e27f5cfae329c8ea82878
-
Filesize
928KB
MD53dcf654fdbe60c9cf1d633ccd9d6f3d7
SHA151ee8a461a27fb9b1940b0296ad02219ddf72a13
SHA25600001a2498d2a92e16579eff239175122d1c790a76b87804d4bbf51e4ce374af
SHA512dd81a4787d13a6d997fb8a0390771b28efd337c9209d3b2f1cb16503f73721e36aa55e4a8e7a2746b7a3312a24ba699fa216b461de5e27f5cfae329c8ea82878
-
Filesize
96KB
MD543564b7dbdf619e28334973fbf61b29b
SHA17dd28aa2654e22a59c01f6e71a7a9daf386b9479
SHA256cf9e1af309de242fe453d36c22ec86e09c5b9dc0ddcf1696510ee00f4b0b475e
SHA512a9e7842d6f63b0a5fa5a20ac1b893d4a0fa6781af9387d6735d86e82cb2667d58bba0ce5b1ec46d94a629ab77d652fd069a92b1bf47b62947a76af423e38ac75
-
Filesize
120KB
MD57aaf9f850b21512678623a9206f572a3
SHA11b13e31efa4b32e368010e6a4d02436373220279
SHA256ad46a43f535d647ab6ed9a8badcee1eff3497e45348844be327f505905b66e2b
SHA512af2e2fe324928da0c9d59fa9f20bc5614ffe414b5d460296c81452acd0952ee523b75e6a7163c35a52b5b7e134739736331297da6e466d64edf3785222f7ab9d
-
Filesize
120KB
MD57aaf9f850b21512678623a9206f572a3
SHA11b13e31efa4b32e368010e6a4d02436373220279
SHA256ad46a43f535d647ab6ed9a8badcee1eff3497e45348844be327f505905b66e2b
SHA512af2e2fe324928da0c9d59fa9f20bc5614ffe414b5d460296c81452acd0952ee523b75e6a7163c35a52b5b7e134739736331297da6e466d64edf3785222f7ab9d
-
Filesize
363KB
MD5b31ad1bacfd7c51f35e052b8c7047d44
SHA1ba58ae4a4a28cd2a4c2a7b85d260e105fa6e79de
SHA256117ae53cf3e8bc95e6297a15d8365efd792da04df90744d4e244bbf72075ccc3
SHA5122a4c0d3f7065a9272bd70e8fd121e80d9c4e3d9089285841b245790f4789704c27cb88333ddbf3bbecbc26af926b7ffd7a722352c7f418c84a9087cb1a748368
-
Filesize
633KB
MD58600d8d22512459f9a195e82610af90a
SHA12f173a9698d0679f1ba366375e78a902aff91528
SHA2563c33935f5ad8d991f2eb7419e08b6539cabc68584f24bbcc7b5f07dd59b88202
SHA512bbf9a936777890b524068db2d9e072ba5402866389c5a5f0799ad4f6973395820b6a330d465fe6615102f1178571b4e480ed9f00992f607df6bd565d5cfea0fb
-
Filesize
633KB
MD58600d8d22512459f9a195e82610af90a
SHA12f173a9698d0679f1ba366375e78a902aff91528
SHA2563c33935f5ad8d991f2eb7419e08b6539cabc68584f24bbcc7b5f07dd59b88202
SHA512bbf9a936777890b524068db2d9e072ba5402866389c5a5f0799ad4f6973395820b6a330d465fe6615102f1178571b4e480ed9f00992f607df6bd565d5cfea0fb
-
Filesize
880KB
-
Filesize
5.7MB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
340KB
-
Filesize
2.1MB
-
Filesize
488KB
-
Filesize
364KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
364KB
-
Filesize
488KB
-
Filesize
364KB
-
Filesize
340KB
-
Filesize
148KB
-
Filesize
364KB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
148KB
-
Filesize
364KB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
908KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
364KB
-
Filesize
5.7MB
-
Filesize
908KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
464KB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
464KB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
148KB
-
Filesize
464KB
-
Filesize
364KB
-
Filesize
1.1MB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
880KB
-
Filesize
908KB
-
Filesize
5.7MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
464KB
-
Filesize
1.1MB
-
Filesize
5.7MB
-
Filesize
364KB
-
Filesize
2.1MB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
340KB
-
Filesize
340KB
-
Filesize
340KB