Analysis
-
max time kernel
35s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-05-2021 18:52
Static task
static1
Behavioral task
behavioral1
Sample
719694DFB934F138D996919703BFC867.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
719694DFB934F138D996919703BFC867.exe
Resource
win10v20210408
General
-
Target
719694DFB934F138D996919703BFC867.exe
-
Size
4.2MB
-
MD5
719694dfb934f138d996919703bfc867
-
SHA1
dc22f30aa998372eb206cb50f6947f7d29b43f6e
-
SHA256
2e32799ea160a52100d3e33de1b9b6fd33c38452a86d0b77cb7d17bdeb4f71f7
-
SHA512
f98f3b4ed895a3b90cdb92c43ce80e35c0d5aca46b906822d98cda902b13c98446304dad7306fb10186d78eea2e10151749329a0f3512ce3dc1890927c578c8a
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurl.dll aspack_v212_v242 -
Executes dropped EXE 2 IoCs
Processes:
setup_installer.exesetup_install.exepid process 3184 setup_installer.exe 3436 setup_install.exe -
Loads dropped DLL 6 IoCs
Processes:
setup_install.exepid process 3436 setup_install.exe 3436 setup_install.exe 3436 setup_install.exe 3436 setup_install.exe 3436 setup_install.exe 3436 setup_install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1016 3436 WerFault.exe setup_install.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WerFault.exepid process 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1016 WerFault.exe Token: SeBackupPrivilege 1016 WerFault.exe Token: SeDebugPrivilege 1016 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
719694DFB934F138D996919703BFC867.exesetup_installer.exedescription pid process target process PID 860 wrote to memory of 3184 860 719694DFB934F138D996919703BFC867.exe setup_installer.exe PID 860 wrote to memory of 3184 860 719694DFB934F138D996919703BFC867.exe setup_installer.exe PID 860 wrote to memory of 3184 860 719694DFB934F138D996919703BFC867.exe setup_installer.exe PID 3184 wrote to memory of 3436 3184 setup_installer.exe setup_install.exe PID 3184 wrote to memory of 3436 3184 setup_installer.exe setup_install.exe PID 3184 wrote to memory of 3436 3184 setup_installer.exe setup_install.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\719694DFB934F138D996919703BFC867.exe"C:\Users\Admin\AppData\Local\Temp\719694DFB934F138D996919703BFC867.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 4604⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\setup_install.exeMD5
67698a49103bb72d2516be86ceacce99
SHA189e2ec98d20c9d4a98d95cb40f2891292a27e545
SHA256798ec5d3fcd6b3255962df499abbee2cd4ea32e9632c4cdd1ffbfcca32ab5938
SHA5121764d29dffff42c98f44cf6dd68fe1a949bc8eb6f245fda3845da5271f88dd6dcbcadf2b5739a2cdf61e9c726fdb89e9f0bb930f1d26ad9aa2c1356bca792dfd
-
C:\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\setup_install.exeMD5
67698a49103bb72d2516be86ceacce99
SHA189e2ec98d20c9d4a98d95cb40f2891292a27e545
SHA256798ec5d3fcd6b3255962df499abbee2cd4ea32e9632c4cdd1ffbfcca32ab5938
SHA5121764d29dffff42c98f44cf6dd68fe1a949bc8eb6f245fda3845da5271f88dd6dcbcadf2b5739a2cdf61e9c726fdb89e9f0bb930f1d26ad9aa2c1356bca792dfd
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
b7cd0139066eaa3d9987461892d685e1
SHA112892dc4ffcccedc7bb72d7b71a9eb4e58405e59
SHA256834e78f217706696b3707dcf881c680896598df5ac0a2524cef9122128c3fb65
SHA512fbdfcd8eaa52590f8dffe78b7dc45481a6ccdcb7f0b2cf0cbe9f9467750b5e05a10722797e82c8bdd6554d9f5c954ac63b4391f1cb6873520d790fa79ca7f594
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
b7cd0139066eaa3d9987461892d685e1
SHA112892dc4ffcccedc7bb72d7b71a9eb4e58405e59
SHA256834e78f217706696b3707dcf881c680896598df5ac0a2524cef9122128c3fb65
SHA512fbdfcd8eaa52590f8dffe78b7dc45481a6ccdcb7f0b2cf0cbe9f9467750b5e05a10722797e82c8bdd6554d9f5c954ac63b4391f1cb6873520d790fa79ca7f594
-
\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS07CCAAB4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
memory/3184-114-0x0000000000000000-mapping.dmp
-
memory/3436-132-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3436-131-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3436-117-0x0000000000000000-mapping.dmp
-
memory/3436-133-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3436-134-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3436-135-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3436-136-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3436-137-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3436-138-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB