e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757

General

Target

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe
Size

622KB
MD5

510fd18706accdd42ebcb417ca8e3884
SHA1

81af3d7819030bfba06dd0c2b40a3ccf0f1f3ae0
SHA256

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757
SHA512

d5585f7284120646d2930c5d3748807f1555893eb7d38445eb2ab956ffb745b481716ae311f004ca23ba0e95026e93868d07e1b4d35420fb3d89d4c683b79bfa

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\fKgqa.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\fKgqa.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

fKgqa.exe

pid process

1108 fKgqa.exe

pid	process
1108	fKgqa.exe

Loads dropped DLL 2 IoCs

Processes:

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe

pid	process
788	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe
788	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe

Drops file in Program Files directory 64 IoCs

Processes:

fKgqa.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Mail\wab.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\misc.exe	fKgqa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	fKgqa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	fKgqa.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	fKgqa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	fKgqa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUME011.tmp\GoogleUpdateSetup.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	fKgqa.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	fKgqa.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	fKgqa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	fKgqa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	fKgqa.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe	fKgqa.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	fKgqa.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	fKgqa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exefKgqa.exe

description	pid	process	target process
PID 788 wrote to memory of 1108	788	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 788 wrote to memory of 1108	788	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 788 wrote to memory of 1108	788	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 788 wrote to memory of 1108	788	e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe	fKgqa.exe
PID 1108 wrote to memory of 304	1108	fKgqa.exe	cmd.exe
PID 1108 wrote to memory of 304	1108	fKgqa.exe	cmd.exe
PID 1108 wrote to memory of 304	1108	fKgqa.exe	cmd.exe
PID 1108 wrote to memory of 304	1108	fKgqa.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe
"C:\Users\Admin\AppData\Local\Temp\e96452654e381bac55a79060691da4b0205a118989b413bfe19d927eede21757.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\70dd2a6d.bat" "
3⤵
PID:304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\70dd2a6d.bat
MD5
190c05b695c0d9eb2cfc40c0ef0e2584

SHA1
deab7239c25a95feb5c72d265e2c71da4829c596

SHA256
da970a9bfe7cd5ce949ea80176c9741614d362877da9a943896501d61c1c879f

SHA512
81a37e0f57fd4cae116476ccbc395cef9cd89d5fc0e1812ce88d61c965c0f773e5de3f6e636e6ea8f4134d2bc45f55b94a78dd053bc090f7c8c4eef336926beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fKgqa.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\fKgqa.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\fKgqa.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/304-66-0x0000000000000000-mapping.dmp

Download
memory/1108-62-0x0000000000000000-mapping.dmp

Download
memory/1108-64-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads