faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390

General

Target

faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe
Size

5.7MB
MD5

157eeae54cbbd64c68dffa9afd621200
SHA1

0aa05b0dc6eb66723757f00edbcee84e146400d2
SHA256

faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390
SHA512

c866e94074fe18e848af6bb664fc1f3d80f6a100ee10a1d379a34dccce6b12e97b2ec25b4f88ca90a58cc0d2d0271b822661940c536e9698d9a6fda4cb20f3fa
SSDEEP

98304:kJbQY+Jhc8rW9Fx8oIa1kir1Ih1cjWsRD3mol00aW5QuWsObVThNGVaqaKu96rbJ:KfF8rgjRkv4Wst3mk00aW5QuWsO4Ta7z

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\HPSocket.dll	acprotect
C:\Users\Admin\AppData\Local\Temp\HPSocket.dll	acprotect

Loads dropped DLL 1 IoCs

Processes:

faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

pid process

5008 faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\HPSocket.dll	upx
behavioral2/memory/5008-151-0x00000000746E0000-0x0000000074719000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\HPSocket.dll	upx
behavioral2/memory/5008-168-0x00000000746E0000-0x0000000074719000-memory.dmp	upx
behavioral2/memory/5008-175-0x00000000746E0000-0x0000000074719000-memory.dmp	upx
behavioral2/memory/5008-194-0x00000000746E0000-0x0000000074719000-memory.dmp	upx
behavioral2/memory/5008-196-0x00000000746E0000-0x0000000074719000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

description pid process

Token: SeDebugPrivilege 5008 faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

description	pid	process
Token: SeDebugPrivilege	5008	faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

pid	process
5008	faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe
5008	faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe

C:\Users\Admin\AppData\Local\Temp\faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe
"C:\Users\Admin\AppData\Local\Temp\faad09e86a82d43545eb2e5f7155f9de6b449dec90c163337d0cc5e578db6390.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HPSocket.dll
Filesize
80KB

MD5
b220f0b3057a925147f57c5ebff51523

SHA1
bb9faca3b0e9f849301ecbd58381e7965a143781

SHA256
f12af891c0c1cb5e793ab260ff92e9792c8f7f2541162390a44c27e2e954dcb8

SHA512
1e9fb6bd6005aab4f553b0a02c373671ce26fa773b06461e0041cfad0ae62bbf319105296ebd5e2c1ccf1c478ce17510aeb32dab8b83254fa2a18c9148f121f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\HPSocket.dll
Filesize
80KB

MD5
b220f0b3057a925147f57c5ebff51523

SHA1
bb9faca3b0e9f849301ecbd58381e7965a143781

SHA256
f12af891c0c1cb5e793ab260ff92e9792c8f7f2541162390a44c27e2e954dcb8

SHA512
1e9fb6bd6005aab4f553b0a02c373671ce26fa773b06461e0041cfad0ae62bbf319105296ebd5e2c1ccf1c478ce17510aeb32dab8b83254fa2a18c9148f121f1

Download Submit
memory/5008-169-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-196-0x00000000746E0000-0x0000000074719000-memory.dmp

Filesize
228KB

Download
memory/5008-133-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-151-0x00000000746E0000-0x0000000074719000-memory.dmp

Filesize
228KB

Download
memory/5008-134-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-160-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/5008-161-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/5008-162-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/5008-164-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/5008-165-0x0000000005A70000-0x0000000005A71000-memory.dmp

Filesize
4KB

Download
memory/5008-163-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/5008-166-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/5008-167-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-168-0x00000000746E0000-0x0000000074719000-memory.dmp

Filesize
228KB

Download
memory/5008-135-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-172-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-136-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-174-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-175-0x00000000746E0000-0x0000000074719000-memory.dmp

Filesize
228KB

Download
memory/5008-176-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-178-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-181-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-183-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-185-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-187-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-189-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-191-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-193-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-194-0x00000000746E0000-0x0000000074719000-memory.dmp

Filesize
228KB

Download
memory/5008-195-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download
memory/5008-170-0x0000000000400000-0x00000000014A9000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads