5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd

General

Target

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe
Size

92KB
MD5

2cf1277a5b8a439d5adbafa86e684c7c
SHA1

89d97f8714e79bd2fbe861523d3a177f278cc994
SHA256

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd
SHA512

9709bac0d7e19c2da443d4d64c5e584e33fe0ee138293776295df4c4eb4682bea48d61c47b0abda12888ad68422be88fec976139db189020c29d978c0e3724df

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\XkBfhV.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\XkBfhV.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

XkBfhV.exe

pid process

1504 XkBfhV.exe

pid	process
1504	XkBfhV.exe

Loads dropped DLL 2 IoCs

Processes:

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe

pid	process
1096	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe
1096	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe

Drops file in Program Files directory 64 IoCs

Processes:

XkBfhV.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	XkBfhV.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	XkBfhV.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\WinMail.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe	XkBfhV.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	XkBfhV.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	XkBfhV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exeXkBfhV.exe

description	pid	process	target process
PID 1096 wrote to memory of 1504	1096	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 1096 wrote to memory of 1504	1096	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 1096 wrote to memory of 1504	1096	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 1096 wrote to memory of 1504	1096	5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe	XkBfhV.exe
PID 1504 wrote to memory of 1380	1504	XkBfhV.exe	cmd.exe
PID 1504 wrote to memory of 1380	1504	XkBfhV.exe	cmd.exe
PID 1504 wrote to memory of 1380	1504	XkBfhV.exe	cmd.exe
PID 1504 wrote to memory of 1380	1504	XkBfhV.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe
"C:\Users\Admin\AppData\Local\Temp\5344a6e1bc80715ad0b1302032bfaf07d73dd6fda01976137595dff02674fddd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\2c5928b1.bat" "
3⤵
PID:1380

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2c5928b1.bat
MD5
b3746924080d750c24f00d70177dd324

SHA1
090213c2e0ec89892586fce4f9abcb2e3afdfc66

SHA256
987f30914b08080d730e312c0ee85b35aae3085c908588f5063f60ac982c6333

SHA512
a45261577198e98e84b0a2e4607a7447137469fcacf922abb95af6ccb76b43fecaf73efd9911712f8d5e8b28aa87660a1a63dbd74c2c11324483c71d71c22e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkBfhV.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\XkBfhV.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
\Users\Admin\AppData\Local\Temp\XkBfhV.exe
MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/1380-66-0x0000000000000000-mapping.dmp

Download
memory/1504-62-0x0000000000000000-mapping.dmp

Download
memory/1504-64-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads