221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251

General

Target

221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
Size

3.1MB
MD5

349342519350e96733b76c2c566e6645
SHA1

9f8cf77845e20824dbde2ec001f2d48b3fd58789
SHA256

221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251
SHA512

050c5c2f8f472e9991659eb0859b2c05c2a42314aea15c1999136ff4f22c445d00f212bdfbd2afb9131a8cb2b6e8710e918913f751a235ec40acb208bd289b7d
SSDEEP

49152:win2itBw7Z7PejkGJdKQUelpLSqVhX2fMWV3CwajjCLaYbvDx5V13O+mODBnVZ8U:winjM13GJJlpRVhXQnOjCLjbvbVxhLZ5

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000012302-55.dat	acprotect
behavioral1/files/0x000b000000012302-67.dat	acprotect
behavioral1/files/0x000b000000012302-68.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
948	is-GC5KC.tmp

Loads dropped DLL 5 IoCs

pid	Process
1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
948	is-GC5KC.tmp
948	is-GC5KC.tmp
948	is-GC5KC.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	is-GC5KC.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28
PID 1640 wrote to memory of 948	1640	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	28

C:\Users\Admin\AppData\Local\Temp\221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
"C:\Users\Admin\AppData\Local\Temp\221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\is-AHPFP.tmp\is-GC5KC.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AHPFP.tmp\is-GC5KC.tmp" /SL4 $70122 "C:\Users\Admin\AppData\Local\Temp\221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe" 2882318 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-AHPFP.tmp\is-GC5KC.tmp

Filesize
634KB

MD5
d291acbf9866b8846fe0629e690feb1a

SHA1
293314b11340d798d3c74e2416e2a43f267a25d6

SHA256
ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb

SHA512
320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AHPFP.tmp\is-GC5KC.tmp

Filesize
634KB

MD5
d291acbf9866b8846fe0629e690feb1a

SHA1
293314b11340d798d3c74e2416e2a43f267a25d6

SHA256
ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb

SHA512
320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\kpk9D69.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
\Users\Admin\AppData\Local\Temp\is-AHPFP.tmp\is-GC5KC.tmp

Filesize
634KB

MD5
d291acbf9866b8846fe0629e690feb1a

SHA1
293314b11340d798d3c74e2416e2a43f267a25d6

SHA256
ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb

SHA512
320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed

Download Submit
\Users\Admin\AppData\Local\Temp\is-HE29J.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-HE29J.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\kpk9D69.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
\Users\Admin\AppData\Local\Temp\kpk9D69.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
memory/948-71-0x0000000000370000-0x00000000003E4000-memory.dmp

Filesize
464KB

Download
memory/1640-65-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1640-66-0x00000000002E0000-0x0000000000354000-memory.dmp

Filesize
464KB

Download
memory/1640-64-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1640-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1640-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-72-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/1640-73-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing