a7380ab000584685bb2bba25704046915d0bdaaf3a809bf80c84bbe27f765e49

Analysis

max time kernel
124s
max time network
57s
platform
windows7_x64
resource
win7v20210408
submitted
31/05/2021, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4A53B92B00FC052FC1B90D7130515E2F.exe
Size 4.2MB
Sample210531-8mrdtcc2ea
SHA256 a7380ab000584685bb2bba25704046915d0bdaaf3a809bf80c84bbe27f765e49
MD5 4a53b92b00fc052fc1b90d7130515e2f
SHA1 777c02934c33d07f2f37c9be6abafafc4b885eb1
SHA512 73f95af28366b269ab69f4d54b905a034d1c4bc492721d65d38204bb859a35fd4677d4a00f369081a43ff6d7605c544c09633f01a42c1a7ebca8b1899f23d033
MD5 SHA1 SHA512

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130d7-68.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-69.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-72.dat	aspack_v212_v242
behavioral1/files/0x00050000000130ca-78.dat	aspack_v212_v242
behavioral1/files/0x00050000000130ca-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cb-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cb-75.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cd-81.dat	aspack_v212_v242
behavioral1/files/0x00030000000130cd-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-87.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-86.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-85.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-84.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-102.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-104.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-103.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d7-105.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1356	setup_installer.exe
108	setup_install.exe

Loads dropped DLL 19 IoCs

pid	Process
1892	4A53B92B00FC052FC1B90D7130515E2F.exe
1356	setup_installer.exe
1356	setup_installer.exe
1356	setup_installer.exe
1356	setup_installer.exe
1356	setup_installer.exe
1356	setup_installer.exe
108	setup_install.exe
108	setup_install.exe
108	setup_install.exe
108	setup_install.exe
108	setup_install.exe
108	setup_install.exe
108	setup_install.exe
108	setup_install.exe
556	WerFault.exe
556	WerFault.exe
556	WerFault.exe
556	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
556	108	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
556	WerFault.exe
556	WerFault.exe
556	WerFault.exe
556	WerFault.exe
556	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
556	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	WerFault.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1892 wrote to memory of 1356	1892	4A53B92B00FC052FC1B90D7130515E2F.exe	26
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 1356 wrote to memory of 108	1356	setup_installer.exe	30
PID 108 wrote to memory of 556	108	setup_install.exe	32
PID 108 wrote to memory of 556	108	setup_install.exe	32
PID 108 wrote to memory of 556	108	setup_install.exe	32
PID 108 wrote to memory of 556	108	setup_install.exe	32
PID 108 wrote to memory of 556	108	setup_install.exe	32
PID 108 wrote to memory of 556	108	setup_install.exe	32
PID 108 wrote to memory of 556	108	setup_install.exe	32

C:\Users\Admin\AppData\Local\Temp\4A53B92B00FC052FC1B90D7130515E2F.exe
"C:\Users\Admin\AppData\Local\Temp\4A53B92B00FC052FC1B90D7130515E2F.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\7zSC45971D4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC45971D4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 352
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-99-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/108-91-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/108-93-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/108-92-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/108-94-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/108-95-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/108-96-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/108-98-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/108-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/108-97-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/108-88-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/108-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/556-106-0x0000000000270000-0x00000000002D0000-memory.dmp

Download

memory/1892-59-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download