e7c3cea59ec83faa8886c1a5d0b0eabd00cf68ae8491ad6a985f3b6e422c0d19

General

Target

4AB92989A8709A31EDB4ECBFFD8E0AD5.exe
Size

3.8MB
MD5

4ab92989a8709a31edb4ecbffd8e0ad5
SHA1

7a7f62356a67071b0943686b57232c13289fd075
SHA256

e7c3cea59ec83faa8886c1a5d0b0eabd00cf68ae8491ad6a985f3b6e422c0d19
SHA512

b92b9a4953baa29b095ffa4789fe825aa71e2de82d73999a3f010a3fe03c509ce28412f3ac18081c2ce8fa2e08e1cebda2e0d14c4f38b515fd0c3a967e54f57c

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130dc-69.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-73.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d1-77.dat	aspack_v212_v242
behavioral1/files/0x00050000000130d0-78.dat	aspack_v212_v242
behavioral1/files/0x00050000000130d0-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d3-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d3-83.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-88.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-87.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-86.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-85.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-103.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-105.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-104.dat	aspack_v212_v242
behavioral1/files/0x00030000000130dc-106.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1912	setup_installer.exe
2032	setup_install.exe

Loads dropped DLL 19 IoCs

pid	Process
108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe
1912	setup_installer.exe
1912	setup_installer.exe
1912	setup_installer.exe
1912	setup_installer.exe
1912	setup_installer.exe
1912	setup_installer.exe
2032	setup_install.exe
2032	setup_install.exe
2032	setup_install.exe
2032	setup_install.exe
2032	setup_install.exe
2032	setup_install.exe
2032	setup_install.exe
2032	setup_install.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
696	2032	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe
696	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
696	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	696	WerFault.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 108 wrote to memory of 1912	108	4AB92989A8709A31EDB4ECBFFD8E0AD5.exe	26
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 1912 wrote to memory of 2032	1912	setup_installer.exe	29
PID 2032 wrote to memory of 696	2032	setup_install.exe	32
PID 2032 wrote to memory of 696	2032	setup_install.exe	32
PID 2032 wrote to memory of 696	2032	setup_install.exe	32
PID 2032 wrote to memory of 696	2032	setup_install.exe	32
PID 2032 wrote to memory of 696	2032	setup_install.exe	32
PID 2032 wrote to memory of 696	2032	setup_install.exe	32
PID 2032 wrote to memory of 696	2032	setup_install.exe	32

C:\Users\Admin\AppData\Local\Temp\4AB92989A8709A31EDB4ECBFFD8E0AD5.exe
"C:\Users\Admin\AppData\Local\Temp\4AB92989A8709A31EDB4ECBFFD8E0AD5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\7zS87743E54\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS87743E54\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 352
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-60-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Filesize
8KB

Download
memory/696-107-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2032-93-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2032-96-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2032-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2032-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2032-99-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2032-100-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2032-95-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2032-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2032-92-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2032-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2032-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2032-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing