4e9bb871716df27af35ede8b153efa96e131321fa3ced426fce64b893ebd089a

General

Target

BBA60DFA5E58997112A5829898E2A7DD.exe
Size

3.9MB
MD5

bba60dfa5e58997112a5829898e2a7dd
SHA1

b0b3f12499471d97d337396b9dd652497e070866
SHA256

4e9bb871716df27af35ede8b153efa96e131321fa3ced426fce64b893ebd089a
SHA512

fc7ceccfba312cd787cfe7c6674465848bd7a89d4130b68ebfe3839be92cc8567e3d6d97e974eb3ddd11dd7071fa43632e9dec4df298c7b431213c30a52936bd

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130e5-60.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-61.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-62.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-64.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d8-67.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d8-68.dat	aspack_v212_v242
behavioral1/files/0x00050000000130d7-69.dat	aspack_v212_v242
behavioral1/files/0x00050000000130d7-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130da-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130da-73.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-78.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-94.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-95.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-96.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e5-97.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
468	setup_install.exe

Loads dropped DLL 15 IoCs

pid	Process
1988	BBA60DFA5E58997112A5829898E2A7DD.exe
1988	BBA60DFA5E58997112A5829898E2A7DD.exe
1988	BBA60DFA5E58997112A5829898E2A7DD.exe
468	setup_install.exe
468	setup_install.exe
468	setup_install.exe
468	setup_install.exe
468	setup_install.exe
468	setup_install.exe
468	setup_install.exe
468	setup_install.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
436	468	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe
436	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 1988 wrote to memory of 468	1988	BBA60DFA5E58997112A5829898E2A7DD.exe	29
PID 468 wrote to memory of 436	468	setup_install.exe	31
PID 468 wrote to memory of 436	468	setup_install.exe	31
PID 468 wrote to memory of 436	468	setup_install.exe	31
PID 468 wrote to memory of 436	468	setup_install.exe	31
PID 468 wrote to memory of 436	468	setup_install.exe	31
PID 468 wrote to memory of 436	468	setup_install.exe	31
PID 468 wrote to memory of 436	468	setup_install.exe	31

C:\Users\Admin\AppData\Local\Temp\BBA60DFA5E58997112A5829898E2A7DD.exe
"C:\Users\Admin\AppData\Local\Temp\BBA60DFA5E58997112A5829898E2A7DD.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\7zS4C726705\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4C726705\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 352
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-98-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/468-82-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/468-91-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/468-87-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/468-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/468-85-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/468-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/468-84-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/468-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/468-86-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/468-83-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/468-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/468-80-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1988-59-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing