76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab

Analysis

max time kernel
148s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe
Size

6.2MB
MD5

5842a6c45ad72f004cfa7bd90d95b0dc
SHA1

80472a89e5e11c2cdffa281667e1d280c20d3dee
SHA256

76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab
SHA512

00814a5fa70b12cf547e5b8dad6b801395f72dc309fe656a78c49e9cd32ed738f405fa8af96b9525d4c1cbb15860fe791c4b50ee0fd58eb2ecf5c48c2341a1b1
SSDEEP

98304:w7M1xJHb4Q8Ihu3CB5+4cDMGZwBKbS30I4L5tkFh3+x9harqSLlvgrMAJrOztWx:w7UxJ0Q8BMEtpFN1Lc/3+x90JafOE

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000139f7-56.dat	acprotect
behavioral1/files/0x00090000000139f7-66.dat	acprotect
behavioral1/files/0x00090000000139f7-65.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
916	install.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1500-55-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1500-72-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe
1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe
916	install.exe
916	install.exe
916	install.exe
916	install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe
916	install.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27
PID 1500 wrote to memory of 916	1500	76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe	27

C:\Users\Admin\AppData\Local\Temp\76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe
"C:\Users\Admin\AppData\Local\Temp\76eee07d720405e8d6c0165441c6a5180202770f8ab2820aee55e0f7d21676ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\install.dat

Filesize
8.5MB

MD5
72b75fb7ddd3c9fcd0b68ec1243f4a8a

SHA1
ae0d31b182a9330f7c5d5af43ee1c9abc413ecd6

SHA256
43d118add4ae4a39284930a8539394ff492d1d1231202948933b53024dbceffd

SHA512
9217bf24138b6aab3fd6c515f30cb0643690c547d6786bca4daf69b041edcd4037d5f6959c709285244454ec597275c0f7967fc2af8fd9779db3169ddfba6f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
432KB

MD5
d8eda4a99ff80a6d20d6c76b70359875

SHA1
9be3072043a093e0c4dd80024d58e4c20b4feb7f

SHA256
4b10ededba918ad41821e5b2d438f2d35618ca7e6bc2481ed4f046b8c194dfc8

SHA512
60f27d76f89196921983336ff35e6d5bfa5da9c49e88a89f379ff3f7fafedf35e4d15d89f9d3ff972c4931caaff200f38db2c7c158b34fd8c350d71ece24a04e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
432KB

MD5
d8eda4a99ff80a6d20d6c76b70359875

SHA1
9be3072043a093e0c4dd80024d58e4c20b4feb7f

SHA256
4b10ededba918ad41821e5b2d438f2d35618ca7e6bc2481ed4f046b8c194dfc8

SHA512
60f27d76f89196921983336ff35e6d5bfa5da9c49e88a89f379ff3f7fafedf35e4d15d89f9d3ff972c4931caaff200f38db2c7c158b34fd8c350d71ece24a04e

Download Submit
C:\Users\Admin\AppData\Local\Temp\abk1305.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
432KB

MD5
d8eda4a99ff80a6d20d6c76b70359875

SHA1
9be3072043a093e0c4dd80024d58e4c20b4feb7f

SHA256
4b10ededba918ad41821e5b2d438f2d35618ca7e6bc2481ed4f046b8c194dfc8

SHA512
60f27d76f89196921983336ff35e6d5bfa5da9c49e88a89f379ff3f7fafedf35e4d15d89f9d3ff972c4931caaff200f38db2c7c158b34fd8c350d71ece24a04e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
432KB

MD5
d8eda4a99ff80a6d20d6c76b70359875

SHA1
9be3072043a093e0c4dd80024d58e4c20b4feb7f

SHA256
4b10ededba918ad41821e5b2d438f2d35618ca7e6bc2481ed4f046b8c194dfc8

SHA512
60f27d76f89196921983336ff35e6d5bfa5da9c49e88a89f379ff3f7fafedf35e4d15d89f9d3ff972c4931caaff200f38db2c7c158b34fd8c350d71ece24a04e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
432KB

MD5
d8eda4a99ff80a6d20d6c76b70359875

SHA1
9be3072043a093e0c4dd80024d58e4c20b4feb7f

SHA256
4b10ededba918ad41821e5b2d438f2d35618ca7e6bc2481ed4f046b8c194dfc8

SHA512
60f27d76f89196921983336ff35e6d5bfa5da9c49e88a89f379ff3f7fafedf35e4d15d89f9d3ff972c4931caaff200f38db2c7c158b34fd8c350d71ece24a04e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe

Filesize
432KB

MD5
d8eda4a99ff80a6d20d6c76b70359875

SHA1
9be3072043a093e0c4dd80024d58e4c20b4feb7f

SHA256
4b10ededba918ad41821e5b2d438f2d35618ca7e6bc2481ed4f046b8c194dfc8

SHA512
60f27d76f89196921983336ff35e6d5bfa5da9c49e88a89f379ff3f7fafedf35e4d15d89f9d3ff972c4931caaff200f38db2c7c158b34fd8c350d71ece24a04e

Download Submit
\Users\Admin\AppData\Local\Temp\abk1305.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\abk1305.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/916-58-0x0000000000000000-mapping.dmp

Download
memory/916-70-0x0000000000380000-0x00000000003F3000-memory.dmp

Filesize
460KB

Download
memory/916-75-0x0000000000380000-0x00000000003F3000-memory.dmp

Filesize
460KB

Download
memory/1500-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1500-67-0x0000000000820000-0x0000000000844000-memory.dmp

Filesize
144KB

Download
memory/1500-68-0x0000000000820000-0x0000000000844000-memory.dmp

Filesize
144KB

Download
memory/1500-69-0x00000000007C0000-0x0000000000833000-memory.dmp

Filesize
460KB

Download
memory/1500-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1500-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1500-73-0x0000000000820000-0x0000000000844000-memory.dmp

Filesize
144KB

Download
memory/1500-74-0x00000000007C0000-0x0000000000833000-memory.dmp

Filesize
460KB

Download