e2ccb3c0d23f0d04ee8057f5ce3861eea952fb20694c1656c9805b1d4cd922ff

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

instspeedfan452.exe
Size

2.9MB
MD5

9b62520616b647979ad053dffa80311c
SHA1

babeb8bdd47d51e5bb7f66b9197aa0a1b9f3a2aa
SHA256

e2ccb3c0d23f0d04ee8057f5ce3861eea952fb20694c1656c9805b1d4cd922ff
SHA512

edc1981d7a4f191333c43bb7f760f5c58191599965aa1e53ba60777302ba5499b301f43189ecaad045bd22f8bed43205cbb0a0ddb9b68da1389fead8d946971d
SSDEEP

49152:pJAZvThICXI+X/w5zcnTdSljPWHb59XUmisH5VdEPF63gO8FsAA:pJAZvThIqXqzYTYLWnisP2PF63gxtA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3136	speedfan.exe

Loads dropped DLL 28 IoCs

pid	Process
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe
4152	instspeedfan452.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\speedfan.sys	instspeedfan452.exe
File created	C:\Windows\SysWOW64\initdebug.nfo	instspeedfan452.exe
File opened for modification	C:\Windows\SysWOW64\initdebug.nfo	instspeedfan452.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SpeedFan\pciidsdata.csv	instspeedfan452.exe
File created	C:\Program Files (x86)\SpeedFan\configs.zip	instspeedfan452.exe
File created	C:\Program Files (x86)\SpeedFan\sfextra.dll	instspeedfan452.exe
File created	C:\Program Files (x86)\SpeedFan\uninstall.exe	instspeedfan452.exe
File opened for modification	C:\Program Files (x86)\SpeedFan\debug.nfo	speedfan.exe
File created	C:\Program Files (x86)\SpeedFan\debug.nfo	speedfan.exe
File created	C:\Program Files (x86)\SpeedFan\speedfan.exe	instspeedfan452.exe
File created	C:\Program Files (x86)\SpeedFan\speedfan.txt	instspeedfan452.exe
File created	C:\Program Files (x86)\SpeedFan\speedfan.chm	instspeedfan452.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3136	speedfan.exe

C:\Users\Admin\AppData\Local\Temp\instspeedfan452.exe
"C:\Users\Admin\AppData\Local\Temp\instspeedfan452.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4152

C:\Program Files (x86)\SpeedFan\speedfan.exe
"C:\Program Files (x86)\SpeedFan\speedfan.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SpeedFan\speedfan.exe

Filesize
7.8MB

MD5
2ec7b1b5e9fddba22b4f426170e4c834

SHA1
283a9c5ab4640adc35393fe750c9f41cf5f23230

SHA256
4e9f8f2c3528bec9ba78985d8473bcb3be50e28c4c27363333fda80de9649f94

SHA512
4454b37a32438a3db99605f78827aea1b883c9bcb210ef209f794f7eb56bc89dbd3300c511b3f362799bd18aaf25424b85cdd275ef1e01514ea24fc9191d6455

Download Submit
C:\Program Files (x86)\SpeedFan\speedfan.exe

Filesize
7.8MB

MD5
2ec7b1b5e9fddba22b4f426170e4c834

SHA1
283a9c5ab4640adc35393fe750c9f41cf5f23230

SHA256
4e9f8f2c3528bec9ba78985d8473bcb3be50e28c4c27363333fda80de9649f94

SHA512
4454b37a32438a3db99605f78827aea1b883c9bcb210ef209f794f7eb56bc89dbd3300c511b3f362799bd18aaf25424b85cdd275ef1e01514ea24fc9191d6455

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfextra.dll

Filesize
103KB

MD5
dc096997edfbdf22b160d3ea272711cd

SHA1
6064d6bd03de953400b8d8f8abd98b4203cc6a3b

SHA256
5c9a6055049361f3f691f075ff70b547b7cd4a72ecaff81f4390d1e03c389511

SHA512
c7d2d87b24974b952c7c91df9169182902bc393df20927750b4ac27850c5aac6c707d6cb8e2574bbb4d827ccae89a8141526ba70fb018d178f435bdbff93961a

Download Submit
memory/4152-134-0x0000000000490000-0x00000000004AE000-memory.dmp

Filesize
120KB

Download