c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FUCK360.exe
Size

250KB
MD5

7ab51c2e2fdac53f3360bb5c8b73734e
SHA1

076d233ef06971a64f9b009c03627a491444a422
SHA256

8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216
SHA512

35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee
SSDEEP

6144:XaLSyXt5iZ6hyebe81XrTE4/Cw5E2XppJZxA:qLtyGe81XU4rttQ

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\qak4A3.tmp	acprotect
\Windows\Temp\eak629.tmp	acprotect
C:\Windows\Temp\eak629.tmp	acprotect

Executes dropped EXE 1 IoCs

Processes:

rcflye.exe

pid process

1192 rcflye.exe
Loads dropped DLL 3 IoCs

Processes:

FUCK360.exercflye.exe

pid process

2000 FUCK360.exe
1192 rcflye.exe
1192 rcflye.exe
Drops file in System32 directory 2 IoCs

Processes:

FUCK360.exercflye.exe

description ioc process

File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE FUCK360.exe
File created C:\Windows\SysWOW64\hra33.dll rcflye.exe
Drops file in Windows directory 2 IoCs

Processes:

FUCK360.exe

description ioc process

File created C:\Windows\rcflye.exe FUCK360.exe
File opened for modification C:\Windows\rcflye.exe FUCK360.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

FUCK360.exercflye.exe

pid process

2000 FUCK360.exe
1192 rcflye.exe

pid	process
1192	rcflye.exe

description	ioc	process
File opened for modification	C:\WINDOWS\SysWOW64\CMD.EXE	FUCK360.exe
File created	C:\Windows\SysWOW64\hra33.dll	rcflye.exe

description	ioc	process
File created	C:\Windows\rcflye.exe	FUCK360.exe
File opened for modification	C:\Windows\rcflye.exe	FUCK360.exe

Suspicious behavior: MapViewOfSection 45 IoCs

Processes:

FUCK360.exercflye.exe

pid	process
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
2000	FUCK360.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe
1192	rcflye.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

FUCK360.exercflye.exe

description	pid	process
Token: SeDebugPrivilege	2000	FUCK360.exe
Token: SeDebugPrivilege	1192	rcflye.exe
Token: SeTakeOwnershipPrivilege	2000	FUCK360.exe
Token: SeRestorePrivilege	2000	FUCK360.exe
Token: SeBackupPrivilege	2000	FUCK360.exe
Token: SeChangeNotifyPrivilege	2000	FUCK360.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

FUCK360.exercflye.exe

pid process

2000 FUCK360.exe
1192 rcflye.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FUCK360.exe

description	pid	process	target process
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 372	2000	FUCK360.exe	wininit.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 384	2000	FUCK360.exe	csrss.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 420	2000	FUCK360.exe	winlogon.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 468	2000	FUCK360.exe	services.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 476	2000	FUCK360.exe	lsass.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 484	2000	FUCK360.exe	lsm.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 592	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 676	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 748	2000	FUCK360.exe	svchost.exe
PID 2000 wrote to memory of 812	2000	FUCK360.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1664

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:240

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1040

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:592

C:\Windows\rcflye.exe
C:\Windows\rcflye.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1192

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1828

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\FUCK360.exe
"C:\Users\Admin\AppData\Local\Temp\FUCK360.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\eak629.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\Temp\xbkAEB.tmp
Filesize
77KB

MD5
06be485186b658a88dfb242611651506

SHA1
bcdfb1d45086ba1bfac457b3007ccd4b870091a0

SHA256
33b73b618d55a90d2a20e4a3abfdc4abdc24a39105b849b3074c4601b4fd65bf

SHA512
63c896d37800f1f0dd50f92c23665f7030c9a5954b25a2e7286059acfc6aed12446566c83feb4b3c822680a6d3d91bf6746006f3fdd109e2ae993e2d2c3e8bfe

Download Submit
C:\Windows\rcflye.exe
Filesize
250KB

MD5
7ab51c2e2fdac53f3360bb5c8b73734e

SHA1
076d233ef06971a64f9b009c03627a491444a422

SHA256
8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216

SHA512
35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee

Download Submit
C:\Windows\rcflye.exe
Filesize
250KB

MD5
7ab51c2e2fdac53f3360bb5c8b73734e

SHA1
076d233ef06971a64f9b009c03627a491444a422

SHA256
8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216

SHA512
35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee

Download Submit
\Users\Admin\AppData\Local\Temp\qak4A3.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Windows\SysWOW64\hra33.dll
Filesize
8KB

MD5
aabeb05e642b2f9acb86a5dc1a600813

SHA1
abba695b782c0e644b971b65d4dc7b8349714488

SHA256
8b1d4870fdc940da538f225251996794f2f10ab7fff718d1aa884be8468dcfce

SHA512
730fd04e4624f4db8c7c92e786148139d457c5bdc28badb3b1cbb70b61fd7b20655c2feab90c5c91b0d30f42a2d7bccb2ce0120752e223e6df2139c371b4be8a

Download Submit
\Windows\Temp\eak629.tmp
Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1192-67-0x0000000000220000-0x0000000000293000-memory.dmp

Filesize
460KB

Download
memory/1192-66-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1192-82-0x0000000000220000-0x0000000000293000-memory.dmp

Filesize
460KB

Download
memory/1192-83-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1192-88-0x0000000000220000-0x0000000000293000-memory.dmp

Filesize
460KB

Download
memory/2000-65-0x000000007EF90000-0x000000007EF9C000-memory.dmp

Filesize
48KB

Download
memory/2000-64-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2000-63-0x00000000002C0000-0x0000000000333000-memory.dmp

Filesize
460KB

Download