7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70

Analysis

max time kernel
122s
max time network
136s
platform
windows10_x64
resource
win10-en-20211014
submitted
18-10-2021 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe
Size

3.8MB
MD5

6ebf4dbc2f41cfe7c3e55e5a76d2a670
SHA1

ee509d9c5910532340694e17fa0b50d0d9558414
SHA256

7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70
SHA512

c87dd97ab8ca254fd189df96cb04a32ba53c17e3ee46fc0a28217d96c423e2f8c2fa1b45b3d78d5a5138f13cbcf0c19e955edb7547187cc3a45312a7737d9ac3

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS40701F26\libzip.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS40701F26\libzip.dll	aspack_v212_v242

Executes dropped EXE 2 IoCs

Processes:

setup.exesetup_install.exe

pid process

1796 setup.exe
1160 setup_install.exe
Loads dropped DLL 4 IoCs

Processes:

setup_install.exe

pid process

1160 setup_install.exe
1160 setup_install.exe
1160 setup_install.exe
1160 setup_install.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1796	setup.exe
1160	setup_install.exe

pid	process
1160	setup_install.exe
1160	setup_install.exe
1160	setup_install.exe
1160	setup_install.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exesetup.exesetup_install.exe

description	pid	process	target process
PID 2268 wrote to memory of 1796	2268	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe	setup.exe
PID 2268 wrote to memory of 1796	2268	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe	setup.exe
PID 2268 wrote to memory of 1796	2268	7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe	setup.exe
PID 1796 wrote to memory of 1160	1796	setup.exe	setup_install.exe
PID 1796 wrote to memory of 1160	1796	setup.exe	setup_install.exe
PID 1796 wrote to memory of 1160	1796	setup.exe	setup_install.exe
PID 1160 wrote to memory of 2760	1160	setup_install.exe	cmd.exe
PID 1160 wrote to memory of 2760	1160	setup_install.exe	cmd.exe
PID 1160 wrote to memory of 2760	1160	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe
"C:\Users\Admin\AppData\Local\Temp\7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\7zS40701F26\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS40701F26\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\8572490dc48c4520c7.exe
4⤵
PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS40701F26\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS40701F26\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS40701F26\libzip.dll
MD5
81d6f0a42171755753e3bc9b48f43c30

SHA1
b766d96e38e151a6a51d72e753fb92687e8f9d03

SHA256
e186cf97d768a139819278c4ce35e6df65adb2bdaee450409994d4c7c8d7c723

SHA512
461bf23b1ec98d97281fd55308d1384a3f471d0a4b2e68c2a81a98346db9edc3ca2b8dbeb68ae543796f73cc04900ec298554b7ff837db0241863a157b43cda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS40701F26\setup_install.exe
MD5
95267238efdaadc90e81a55365db1920

SHA1
fd272f94372155cb6bb224d5efab77a44a564f5f

SHA256
739d2474436296fd091ea4be35c72f03e5c2b74ee3be189dd2e1c069e0e2e7f3

SHA512
162ad3911a76f9c9996b5234e21bd9e31e87f618bddfc9a9dd0133231473674a0cdc0fea3a01d60ad80341e3f23733057f94a5701e07b808ee06f48b09789364

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS40701F26\setup_install.exe
MD5
95267238efdaadc90e81a55365db1920

SHA1
fd272f94372155cb6bb224d5efab77a44a564f5f

SHA256
739d2474436296fd091ea4be35c72f03e5c2b74ee3be189dd2e1c069e0e2e7f3

SHA512
162ad3911a76f9c9996b5234e21bd9e31e87f618bddfc9a9dd0133231473674a0cdc0fea3a01d60ad80341e3f23733057f94a5701e07b808ee06f48b09789364

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS40701F26\zlib1.dll
MD5
c7d4d685a0af2a09cbc21cb474358595

SHA1
b784599c82bb90d5267fd70aaa42acc0c614b5d2

SHA256
e96b397b499d9eaa3f52eaf496ca8941e80c0ad1544879ccadf02bf2c6a1ecfc

SHA512
fed2c126a499fae6215e0ef7d76aeec45b60417ed11c7732379d1e92c87e27355fe8753efed86af4f58d52ea695494ef674538192fac1e8a2a114467061a108b

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
fda127dfe84cd3297f60230a1380a3bf

SHA1
6d23bef63dbe415ab4d55c65966101bc14190446

SHA256
443a9be81187d834a314a67d57594eef5800086b515d39e68053180c68c011be

SHA512
adea000ddc13491db2fad245930a092615b1583f7dbcef1e5102671daa3ca55419bfb9282f2886c39e091cd81f9752c3365496faec6e567e0ca6c3637faf81c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
fda127dfe84cd3297f60230a1380a3bf

SHA1
6d23bef63dbe415ab4d55c65966101bc14190446

SHA256
443a9be81187d834a314a67d57594eef5800086b515d39e68053180c68c011be

SHA512
adea000ddc13491db2fad245930a092615b1583f7dbcef1e5102671daa3ca55419bfb9282f2886c39e091cd81f9752c3365496faec6e567e0ca6c3637faf81c2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS40701F26\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
\Users\Admin\AppData\Local\Temp\7zS40701F26\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
\Users\Admin\AppData\Local\Temp\7zS40701F26\libzip.dll
MD5
81d6f0a42171755753e3bc9b48f43c30

SHA1
b766d96e38e151a6a51d72e753fb92687e8f9d03

SHA256
e186cf97d768a139819278c4ce35e6df65adb2bdaee450409994d4c7c8d7c723

SHA512
461bf23b1ec98d97281fd55308d1384a3f471d0a4b2e68c2a81a98346db9edc3ca2b8dbeb68ae543796f73cc04900ec298554b7ff837db0241863a157b43cda1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS40701F26\zlib1.dll
MD5
c7d4d685a0af2a09cbc21cb474358595

SHA1
b784599c82bb90d5267fd70aaa42acc0c614b5d2

SHA256
e96b397b499d9eaa3f52eaf496ca8941e80c0ad1544879ccadf02bf2c6a1ecfc

SHA512
fed2c126a499fae6215e0ef7d76aeec45b60417ed11c7732379d1e92c87e27355fe8753efed86af4f58d52ea695494ef674538192fac1e8a2a114467061a108b

Download Submit
memory/1160-118-0x0000000000000000-mapping.dmp

Download
memory/1160-129-0x0000000061880000-0x00000000618B7000-memory.dmp

Filesize
220KB

Download
memory/1160-130-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1160-131-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1160-133-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1160-132-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1796-115-0x0000000000000000-mapping.dmp

Download
memory/2760-134-0x0000000000000000-mapping.dmp

Download