df102108e8beb55334e3976e1cb7f389e8f9ecd23a12c4d71c22921626938c50

General

Target

0DDAACDDC23B1EEFCD65C552B79A86B7.exe
Size

3.9MB
MD5

0ddaacddc23b1eefcd65c552b79a86b7
SHA1

b9e6d4f5f10707ef1125b6dff0a6ad456e38d53c
SHA256

df102108e8beb55334e3976e1cb7f389e8f9ecd23a12c4d71c22921626938c50
SHA512

26de899208d0e0af21b81ef5722361f1e4cb87e08b9215fef7accdd3b5783c25d9a14125c98c6a69c37719c808b1260417a3a669357b86c87b4852cb018936e7

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130c9-60.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-61.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-62.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-64.dat	aspack_v212_v242
behavioral1/files/0x00050000000130bd-67.dat	aspack_v212_v242
behavioral1/files/0x00050000000130bd-68.dat	aspack_v212_v242
behavioral1/files/0x00040000000130ba-69.dat	aspack_v212_v242
behavioral1/files/0x00040000000130ba-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130bf-73.dat	aspack_v212_v242
behavioral1/files/0x00030000000130bf-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-78.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-94.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-96.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-95.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-97.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1356	setup_install.exe

Loads dropped DLL 15 IoCs

pid	Process
1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe
1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe
1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	1356	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1320	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1948 wrote to memory of 1356	1948	0DDAACDDC23B1EEFCD65C552B79A86B7.exe	26
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31
PID 1356 wrote to memory of 1320	1356	setup_install.exe	31

C:\Users\Admin\AppData\Local\Temp\0DDAACDDC23B1EEFCD65C552B79A86B7.exe
"C:\Users\Admin\AppData\Local\Temp\0DDAACDDC23B1EEFCD65C552B79A86B7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\7zSC97ECA94\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC97ECA94\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 352
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-98-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1356-82-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1356-91-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1356-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1356-87-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1356-86-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1356-84-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1356-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1356-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1356-85-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1356-83-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1356-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1356-80-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1948-59-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing