Analysis

  • max time kernel
    122s
  • max time network
    58s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    22-05-2021 05:46

General

  • Target

    a1af783a19ee1d6c4081daba5f2fd8c7.exe

  • Size

    3.2MB

  • MD5

    a1af783a19ee1d6c4081daba5f2fd8c7

  • SHA1

    db8ab65329202bd6f578f65e410d9d85866313ed

  • SHA256

    d472f0cb1d205de54297693f856eae5ad6d0d90be070a6d3e105a79987a54a06

  • SHA512

    7b167174043f34d92a391bfee03e1892eeebf309ae0494324fcb3c2b9761f91bededb9c567aee1513fc73921826e01f3382835173a367665b71eacaf944c21a4

Score
8/10

Malware Config

Signatures

  • ASPack v2.12-2.42 18 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1af783a19ee1d6c4081daba5f2fd8c7.exe
    "C:\Users\Admin\AppData\Local\Temp\a1af783a19ee1d6c4081daba5f2fd8c7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 352
        3⤵
        • Loads dropped DLL
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:452

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\libcurl.dll

    MD5

    d09be1f47fd6b827c81a4812b4f7296f

    SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

    SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

    SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\libcurlpp.dll

    MD5

    e6e578373c2e416289a8da55f1dc5e8e

    SHA1

    b601a229b66ec3d19c2369b36216c6f6eb1c063e

    SHA256

    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

    SHA512

    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\libgcc_s_dw2-1.dll

    MD5

    9aec524b616618b0d3d00b27b6f51da1

    SHA1

    64264300801a353db324d11738ffed876550e1d3

    SHA256

    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

    SHA512

    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\libstdc++-6.dll

    MD5

    5e279950775baae5fea04d2cc4526bcc

    SHA1

    8aef1e10031c3629512c43dd8b0b5d9060878453

    SHA256

    97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

    SHA512

    666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\libwinpthread-1.dll

    MD5

    1e0d62c34ff2e649ebc5c372065732ee

    SHA1

    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

    SHA256

    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

    SHA512

    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • C:\Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\libcurl.dll

    MD5

    d09be1f47fd6b827c81a4812b4f7296f

    SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

    SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

    SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\libcurlpp.dll

    MD5

    e6e578373c2e416289a8da55f1dc5e8e

    SHA1

    b601a229b66ec3d19c2369b36216c6f6eb1c063e

    SHA256

    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

    SHA512

    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\libgcc_s_dw2-1.dll

    MD5

    9aec524b616618b0d3d00b27b6f51da1

    SHA1

    64264300801a353db324d11738ffed876550e1d3

    SHA256

    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

    SHA512

    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\libstdc++-6.dll

    MD5

    5e279950775baae5fea04d2cc4526bcc

    SHA1

    8aef1e10031c3629512c43dd8b0b5d9060878453

    SHA256

    97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

    SHA512

    666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\libwinpthread-1.dll

    MD5

    1e0d62c34ff2e649ebc5c372065732ee

    SHA1

    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

    SHA256

    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

    SHA512

    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • \Users\Admin\AppData\Local\Temp\7zS0544B4C4\setup_install.exe

    MD5

    28976c274c5837421b3c4fd4c419b783

    SHA1

    6a153cd21f2388de7b4c735d2d9bbbb7fe14b8f6

    SHA256

    0a374c0b2ed968011310b006a3d6e0c5ddd9133c7645ffb3fee224e665852d91

    SHA512

    affee68c41316da739ea0f46110bfe6792d24c64b7c9720f216bba95ae3fc512b85ba771f591cdffb0b53d941a884fa57ccc4936dbc586d10ab3d885bce8423e

  • memory/452-99-0x00000000002A0000-0x0000000000300000-memory.dmp

    Filesize

    384KB

  • memory/452-93-0x0000000000000000-mapping.dmp

  • memory/1104-60-0x0000000075551000-0x0000000075553000-memory.dmp

    Filesize

    8KB

  • memory/1996-88-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/1996-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/1996-86-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/1996-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/1996-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/1996-85-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/1996-92-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1996-87-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/1996-84-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1996-83-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/1996-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/1996-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/1996-64-0x0000000000000000-mapping.dmp