221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251

General

Target

221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
Size

3.1MB
MD5

349342519350e96733b76c2c566e6645
SHA1

9f8cf77845e20824dbde2ec001f2d48b3fd58789
SHA256

221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251
SHA512

050c5c2f8f472e9991659eb0859b2c05c2a42314aea15c1999136ff4f22c445d00f212bdfbd2afb9131a8cb2b6e8710e918913f751a235ec40acb208bd289b7d
SSDEEP

49152:win2itBw7Z7PejkGJdKQUelpLSqVhX2fMWV3CwajjCLaYbvDx5V13O+mODBnVZ8U:winjM13GJJlpRVhXQnOjCLjbvbVxhLZ5

Score

9^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000022e13-134.dat	acprotect
behavioral2/files/0x0008000000022e13-133.dat	acprotect
behavioral2/files/0x0008000000022e13-143.dat	acprotect
behavioral2/files/0x0008000000022e13-145.dat	acprotect
behavioral2/files/0x0008000000022e13-144.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3336	is-00J4C.tmp

Loads dropped DLL 4 IoCs

pid	Process
2280	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
2280	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
3336	is-00J4C.tmp
3336	is-00J4C.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2280	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3336	2280	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	82
PID 2280 wrote to memory of 3336	2280	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	82
PID 2280 wrote to memory of 3336	2280	221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe	82

C:\Users\Admin\AppData\Local\Temp\221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe
"C:\Users\Admin\AppData\Local\Temp\221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\is-J03S4.tmp\is-00J4C.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-J03S4.tmp\is-00J4C.tmp" /SL4 $C0062 "C:\Users\Admin\AppData\Local\Temp\221979f779a9a859446688e4d05c34b7ff795400b28a04e1c66480038c079251.exe" 2882318 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-J03S4.tmp\is-00J4C.tmp

Filesize
634KB

MD5
d291acbf9866b8846fe0629e690feb1a

SHA1
293314b11340d798d3c74e2416e2a43f267a25d6

SHA256
ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb

SHA512
320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J03S4.tmp\is-00J4C.tmp

Filesize
634KB

MD5
d291acbf9866b8846fe0629e690feb1a

SHA1
293314b11340d798d3c74e2416e2a43f267a25d6

SHA256
ab3e1fa210171e5ed2decc615c9328379ee3d29b55ee0e5d7ef6bece43f583eb

SHA512
320e68a67fdcf13dc25640cf68468abd9e0dc51b647f95277eebbd06c7c5ee298b1f68d4a01deb886979e42cbc3eddf16ac4db18884a96b1535598ba11ba36ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgi3FC8.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgi3FC8.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgi3FC8.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgi3FC8.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
C:\Users\Admin\AppData\Local\Temp\sgi3FC8.tmp

Filesize
172KB

MD5
4f407b29d53e9eb54e22d096fce82aa7

SHA1
a4ee25b066cac19ff679dd491f5791652bb71185

SHA256
cf0ecf30fc95800a34105acb9bcb484bb594a35b3ef26ace8f122af4f9f888dc

SHA512
325f7b599455195101e4c0dafd3654906d20ed2c1ce2a5f38784635e16ab545df6ee44a83bed6128239be2dee5be110552c7b246b7f52482ab31552e14b54183

Download Submit
memory/2280-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2280-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2280-137-0x0000000002180000-0x00000000021F4000-memory.dmp

Filesize
464KB

Download
memory/2280-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2280-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3336-146-0x0000000000670000-0x00000000006E4000-memory.dmp

Filesize
464KB

Download
memory/3336-147-0x0000000000670000-0x00000000006E4000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing