Analysis
-
max time kernel
36s -
max time network
53s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01-06-2021 03:36
Static task
static1
Behavioral task
behavioral1
Sample
BB67A245F1B9A49C4BF41DADFC8ACE6E.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
BB67A245F1B9A49C4BF41DADFC8ACE6E.exe
Resource
win10v20210408
General
-
Target
BB67A245F1B9A49C4BF41DADFC8ACE6E.exe
-
Size
3.4MB
-
MD5
bb67a245f1b9a49c4bf41dadfc8ace6e
-
SHA1
d16a2b6cc2dcf990b5c022ff75780e512c5893fb
-
SHA256
5b73fe2b2388fcd2b0f2c71f8499221e5ccd1bcfc4e31d2140d5eca1c3a45414
-
SHA512
abd5380fe2d054885a8d3ab378ab2a65885de41684f0af5d4e9c248a1dfd44ecb0852603e2e82f356900514803de4b8e23868e9c597aa58c54410aac5c2ff6f5
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS86BC9A44\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurl.dll aspack_v212_v242 -
Executes dropped EXE 2 IoCs
Processes:
setup_installer.exesetup_install.exepid process 2920 setup_installer.exe 208 setup_install.exe -
Loads dropped DLL 5 IoCs
Processes:
setup_install.exepid process 208 setup_install.exe 208 setup_install.exe 208 setup_install.exe 208 setup_install.exe 208 setup_install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1648 208 WerFault.exe setup_install.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
WerFault.exepid process 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1648 WerFault.exe Token: SeBackupPrivilege 1648 WerFault.exe Token: SeDebugPrivilege 1648 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
BB67A245F1B9A49C4BF41DADFC8ACE6E.exesetup_installer.exedescription pid process target process PID 2988 wrote to memory of 2920 2988 BB67A245F1B9A49C4BF41DADFC8ACE6E.exe setup_installer.exe PID 2988 wrote to memory of 2920 2988 BB67A245F1B9A49C4BF41DADFC8ACE6E.exe setup_installer.exe PID 2988 wrote to memory of 2920 2988 BB67A245F1B9A49C4BF41DADFC8ACE6E.exe setup_installer.exe PID 2920 wrote to memory of 208 2920 setup_installer.exe setup_install.exe PID 2920 wrote to memory of 208 2920 setup_installer.exe setup_install.exe PID 2920 wrote to memory of 208 2920 setup_installer.exe setup_install.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BB67A245F1B9A49C4BF41DADFC8ACE6E.exe"C:\Users\Admin\AppData\Local\Temp\BB67A245F1B9A49C4BF41DADFC8ACE6E.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 4604⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\setup_install.exeMD5
e38081d1d9c403dc006a28e7a27cd58e
SHA16362593680c2949a247b55565abc20c78af5ac80
SHA2567860f9cbd099be045d3a8a5672ea560951c496fcb496a1048afc8381b69b2331
SHA51257f56a42476ee80f99d2d643bee2dd2e7a191c69e1ee0b1f9e165234b28746632987f79bf6f9573ae7d07e0970a27429df52fceff59aa83c67aecacbcf36d894
-
C:\Users\Admin\AppData\Local\Temp\7zS86BC9A44\setup_install.exeMD5
e38081d1d9c403dc006a28e7a27cd58e
SHA16362593680c2949a247b55565abc20c78af5ac80
SHA2567860f9cbd099be045d3a8a5672ea560951c496fcb496a1048afc8381b69b2331
SHA51257f56a42476ee80f99d2d643bee2dd2e7a191c69e1ee0b1f9e165234b28746632987f79bf6f9573ae7d07e0970a27429df52fceff59aa83c67aecacbcf36d894
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
4c8a89533c3dc5d19023179db34add8b
SHA162f568d0c54debae79500184889d39827d6c2132
SHA25685192d457657d437d5c053a63fa54f08227e5694f3917ec280ae715d07bd44fb
SHA512060319f6ad243ed87b51e227edfe525fa805853a799109ebf187bba2a64b08bed4c593ada084f0e85c403c6bd92b47662625ab5e09cc6bc7776ded1bded9d640
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
4c8a89533c3dc5d19023179db34add8b
SHA162f568d0c54debae79500184889d39827d6c2132
SHA25685192d457657d437d5c053a63fa54f08227e5694f3917ec280ae715d07bd44fb
SHA512060319f6ad243ed87b51e227edfe525fa805853a799109ebf187bba2a64b08bed4c593ada084f0e85c403c6bd92b47662625ab5e09cc6bc7776ded1bded9d640
-
\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS86BC9A44\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
memory/208-117-0x0000000000000000-mapping.dmp
-
memory/208-130-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/208-131-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/208-132-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/208-133-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/208-134-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/208-136-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/208-137-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/208-135-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2920-114-0x0000000000000000-mapping.dmp