679d4240ec3562404c1222d91bb2594cb90843b5aec479ce75bd47d4a4e8b780

General

Target

a7cb4a676cab7532471fd9dacfa5778c.exe
Size

3.2MB
MD5

a7cb4a676cab7532471fd9dacfa5778c
SHA1

c67ab56c6d851e3feae04261cbbd31c667448079
SHA256

679d4240ec3562404c1222d91bb2594cb90843b5aec479ce75bd47d4a4e8b780
SHA512

87469d3d83f1a89faf9b81cc594dfbb07d42ff911e49a63f335b8804b127c3083806209062d5a66dfec25e1ac4813e96cfbbc1ab395acd2a1658c0effc158aa6

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130d9-61.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-63.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-62.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-65.dat	aspack_v212_v242
behavioral1/files/0x00050000000130ce-68.dat	aspack_v212_v242
behavioral1/files/0x00050000000130ce-69.dat	aspack_v212_v242
behavioral1/files/0x00040000000130cb-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d0-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d0-75.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-80.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-78.dat	aspack_v212_v242
behavioral1/files/0x00040000000130cb-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-95.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-97.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-96.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d9-98.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
576	setup_install.exe

Loads dropped DLL 15 IoCs

pid	Process
2004	a7cb4a676cab7532471fd9dacfa5778c.exe
2004	a7cb4a676cab7532471fd9dacfa5778c.exe
2004	a7cb4a676cab7532471fd9dacfa5778c.exe
576	setup_install.exe
576	setup_install.exe
576	setup_install.exe
576	setup_install.exe
576	setup_install.exe
576	setup_install.exe
576	setup_install.exe
576	setup_install.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1404	576	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe
1404	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1404	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 2004 wrote to memory of 576	2004	a7cb4a676cab7532471fd9dacfa5778c.exe	29
PID 576 wrote to memory of 1404	576	setup_install.exe	31
PID 576 wrote to memory of 1404	576	setup_install.exe	31
PID 576 wrote to memory of 1404	576	setup_install.exe	31
PID 576 wrote to memory of 1404	576	setup_install.exe	31
PID 576 wrote to memory of 1404	576	setup_install.exe	31
PID 576 wrote to memory of 1404	576	setup_install.exe	31
PID 576 wrote to memory of 1404	576	setup_install.exe	31

C:\Users\Admin\AppData\Local\Temp\a7cb4a676cab7532471fd9dacfa5778c.exe
"C:\Users\Admin\AppData\Local\Temp\a7cb4a676cab7532471fd9dacfa5778c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\7zS4D777C15\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4D777C15\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 352
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-83-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/576-86-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/576-87-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/576-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/576-88-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/576-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/576-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/576-84-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/576-85-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/576-92-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/576-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/576-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1404-99-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/2004-60-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing