2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

Target

8 (15).exe
Size

3.0MB
MD5

bb072cad921aa5ce8b97706ce01bc570
SHA1

18bf034906c1341b7817e7361ad27a4425d820bd
SHA256

817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
SHA512

d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Score

8^/10

aspackv2

Malware Config

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

Executes dropped EXE 2 IoCs

pid	Process
2460	setup_installer.exe
3604	setup_install.exe

Loads dropped DLL 5 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2460	3408	8 (15).exe	75
PID 3408 wrote to memory of 2460	3408	8 (15).exe	75
PID 3408 wrote to memory of 2460	3408	8 (15).exe	75
PID 2460 wrote to memory of 3604	2460	setup_installer.exe	76
PID 2460 wrote to memory of 3604	2460	setup_installer.exe	76
PID 2460 wrote to memory of 3604	2460	setup_installer.exe	76

C:\Users\Admin\AppData\Local\Temp\8 (15).exe
"C:\Users\Admin\AppData\Local\Temp\8 (15).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC9927914\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3604

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact