Analysis

  • max time kernel
    91s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2022, 06:31

General

  • Target

    259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe

  • Size

    250KB

  • MD5

    b4a97d88cfffc4297243eb8cd788eb43

  • SHA1

    3ba3316fbf6a98d790404a8d4146bb976c7edf19

  • SHA256

    259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4

  • SHA512

    888af002f9cfb503fb7a7bb96464dfb5667122661e820ea7657c3d19df0bd8ee9c7a2473971cfe9a1ff89cb05b5aef36a27c26b6c1d2740d0a2ccbc67274c7c3

  • SSDEEP

    6144:4S2Pzdiift/xdCN5WiBbE0MMNCGDckVaWHxTPdSIDwC5jutrD:j2rHtJdQPdM3GAwzTIIDwC9utrD

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe
    "C:\Users\Admin\AppData\Local\Temp\259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\MPlugin_NSIS.dll

    Filesize

    181KB

    MD5

    327880d7f4a76ac165918770f8476a78

    SHA1

    cc6907b073e172419903173beddbc12d9ca7ca6a

    SHA256

    c2422772b5b1afb18e8e1633f4b2dd3229f4c361c6560d0b9e35e13968cc3f23

    SHA512

    81f4382d43d89285d5827d1cefe619b154a05d8199072dbf40dae033bb7ab460858e62d6a9b691f5dc5fd52f7d2989cee0d7b1a4ca5fadb0cde8c27e9834ac19

  • C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\MPlugin_NSIS.dll

    Filesize

    181KB

    MD5

    327880d7f4a76ac165918770f8476a78

    SHA1

    cc6907b073e172419903173beddbc12d9ca7ca6a

    SHA256

    c2422772b5b1afb18e8e1633f4b2dd3229f4c361c6560d0b9e35e13968cc3f23

    SHA512

    81f4382d43d89285d5827d1cefe619b154a05d8199072dbf40dae033bb7ab460858e62d6a9b691f5dc5fd52f7d2989cee0d7b1a4ca5fadb0cde8c27e9834ac19

  • C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\MPlugin_NSIS.dll

    Filesize

    181KB

    MD5

    327880d7f4a76ac165918770f8476a78

    SHA1

    cc6907b073e172419903173beddbc12d9ca7ca6a

    SHA256

    c2422772b5b1afb18e8e1633f4b2dd3229f4c361c6560d0b9e35e13968cc3f23

    SHA512

    81f4382d43d89285d5827d1cefe619b154a05d8199072dbf40dae033bb7ab460858e62d6a9b691f5dc5fd52f7d2989cee0d7b1a4ca5fadb0cde8c27e9834ac19

  • C:\Users\Admin\AppData\Local\Temp\nsq645E.tmp\nsDialogs.dll

    Filesize

    9KB

    MD5

    2aba8f16eca82517460013a3de7cbf67

    SHA1

    3812192fa7b873f426c4b0d0d822b3c9d51aa164

    SHA256

    60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

    SHA512

    4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

  • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

    Filesize

    250KB

    MD5

    b4a97d88cfffc4297243eb8cd788eb43

    SHA1

    3ba3316fbf6a98d790404a8d4146bb976c7edf19

    SHA256

    259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4

    SHA512

    888af002f9cfb503fb7a7bb96464dfb5667122661e820ea7657c3d19df0bd8ee9c7a2473971cfe9a1ff89cb05b5aef36a27c26b6c1d2740d0a2ccbc67274c7c3

  • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe

    Filesize

    250KB

    MD5

    b4a97d88cfffc4297243eb8cd788eb43

    SHA1

    3ba3316fbf6a98d790404a8d4146bb976c7edf19

    SHA256

    259a45bffdea19b505c8efd9e45c0c664df4fac724be63e8deaec8695b1173e4

    SHA512

    888af002f9cfb503fb7a7bb96464dfb5667122661e820ea7657c3d19df0bd8ee9c7a2473971cfe9a1ff89cb05b5aef36a27c26b6c1d2740d0a2ccbc67274c7c3

  • memory/3916-139-0x0000000074CC0000-0x0000000074D57000-memory.dmp

    Filesize

    604KB

  • memory/3916-141-0x0000000074620000-0x00000000746B7000-memory.dmp

    Filesize

    604KB

  • memory/3916-140-0x0000000074CC0000-0x0000000074D57000-memory.dmp

    Filesize

    604KB

  • memory/3916-142-0x0000000074CC0000-0x0000000074D57000-memory.dmp

    Filesize

    604KB

  • memory/3916-143-0x0000000074CC0000-0x0000000074D57000-memory.dmp

    Filesize

    604KB