46e99e70a21a9ecd28e61195f175bea9260eea38b1718f6750166688d955e91e

General

Target

15CC8191E7728032CDABE71FAC938139.exe
Size

3.9MB
MD5

15cc8191e7728032cdabe71fac938139
SHA1

1b23c3637e4ddb26115bd9152525d15b4af73a36
SHA256

46e99e70a21a9ecd28e61195f175bea9260eea38b1718f6750166688d955e91e
SHA512

c5a77d8d0a94785f2715d023584bc024305326baac85539e3cb53b0ad319da35401a9affd745d4248789970f737fafd3bdf7e059624fe3b61347fb0314cc00f8

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000300000001310a-61.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-62.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-63.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-65.dat	aspack_v212_v242
behavioral1/files/0x00050000000130e4-69.dat	aspack_v212_v242
behavioral1/files/0x00050000000130e4-68.dat	aspack_v212_v242
behavioral1/files/0x00040000000130df-70.dat	aspack_v212_v242
behavioral1/files/0x00040000000130df-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e6-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e6-75.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-78.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-80.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-79.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-77.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-95.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-97.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-96.dat	aspack_v212_v242
behavioral1/files/0x000300000001310a-98.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1156	setup_install.exe

Loads dropped DLL 15 IoCs

pid	Process
1608	15CC8191E7728032CDABE71FAC938139.exe
1608	15CC8191E7728032CDABE71FAC938139.exe
1608	15CC8191E7728032CDABE71FAC938139.exe
1156	setup_install.exe
1156	setup_install.exe
1156	setup_install.exe
1156	setup_install.exe
1156	setup_install.exe
1156	setup_install.exe
1156	setup_install.exe
1156	setup_install.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1156	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1608 wrote to memory of 1156	1608	15CC8191E7728032CDABE71FAC938139.exe	26
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31
PID 1156 wrote to memory of 1736	1156	setup_install.exe	31

C:\Users\Admin\AppData\Local\Temp\15CC8191E7728032CDABE71FAC938139.exe
"C:\Users\Admin\AppData\Local\Temp\15CC8191E7728032CDABE71FAC938139.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\7zS8468C184\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8468C184\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 352
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1156-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1156-86-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1156-85-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1156-87-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1156-83-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1156-88-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1156-84-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1156-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1156-92-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1156-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1156-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1608-60-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1736-99-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing