Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows10_x64
10043d28836f...9f.exe
windows7_x64
10043d28836f...9f.exe
windows10_x64
10096fc162ed...c8.exe
windows7_x64
10096fc162ed...c8.exe
windows10_x64
101ad787b5aa...62.exe
windows7_x64
101ad787b5aa...62.exe
windows10_x64
10258cbb13ac...bd.exe
windows7_x64
10258cbb13ac...bd.exe
windows10_x64
1025d79c1a50...7f.exe
windows7_x64
1025d79c1a50...7f.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows10_x64
10500e7e5c00...44.exe
windows7_x64
10500e7e5c00...44.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows10_x64
107dc7ca2414...84.exe
windows7_x64
107dc7ca2414...84.exe
windows10_x64
1096c9fde298...34.exe
windows7_x64
1096c9fde298...34.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows10_x64
10ca14b87b56...83.exe
windows7_x64
10ca14b87b56...83.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
8cbf31d825a...d2.exe
windows10_x64
10Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
08-11-2021 10:07
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral3
Sample
043d28836fc545b0c6daf15ed47be4764ca9ad56d67ba58f84e348a773240b9f.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral4
Sample
043d28836fc545b0c6daf15ed47be4764ca9ad56d67ba58f84e348a773240b9f.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral5
Sample
096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral6
Sample
096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral7
Sample
1ad787b5aa241bdde87b30d49ad286d75e23367b833a7d7e97769ca81ac5ae62.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral8
Sample
1ad787b5aa241bdde87b30d49ad286d75e23367b833a7d7e97769ca81ac5ae62.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral9
Sample
258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral10
Sample
258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral11
Sample
25d79c1a508700c16bfa42039870d590bb3281c271ed02db20899c87259c657f.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral12
Sample
25d79c1a508700c16bfa42039870d590bb3281c271ed02db20899c87259c657f.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral13
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral14
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral15
Sample
500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral16
Sample
500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral17
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral18
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral19
Sample
7dc7ca24149bd2f34bc1bf8942cb3ed8730482e4e90a16b5333092ddb80bd084.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral20
Sample
7dc7ca24149bd2f34bc1bf8942cb3ed8730482e4e90a16b5333092ddb80bd084.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral21
Sample
96c9fde29860a0517d7c1c17de547fe6f64022603e400b0aff5166c4cfee2434.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral22
Sample
96c9fde29860a0517d7c1c17de547fe6f64022603e400b0aff5166c4cfee2434.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral23
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral24
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral25
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral26
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral27
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral28
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
windows10_x64
Behavioral task
behavioral29
Sample
ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe
Resource
win7-en-20211104
windows7_x64
Behavioral task
behavioral30
Sample
ca14b87b565c6b1c90eb3365bed694bd9e8a8b3d0ab6e3ca0c680baec6422f83.exe
Resource
win10-en-20211104
windows10_x64
Behavioral task
behavioral31
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211014
windows7_x64
Behavioral task
behavioral32
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211104
windows10_x64
General
-
Target
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
-
Size
5.6MB
-
MD5
5802bc4fd763cd759b7875e94f9f2eaf
-
SHA1
91eaa6e6f9b5c52a2b91806bfbf513ed336e3f6a
-
SHA256
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2
-
SHA512
91f9c64c61456c91e74cad1c8a5f9aca54e44f00612085721c1b2ad8e9305679f3ed562939b0505843c06b619ab8f4818f3a537e33c122a02569cf080d13181a
Malware Config
Signatures
-
resource yara_rule behavioral31/files/0x00050000000125e7-71.dat aspack_v212_v242 behavioral31/files/0x00050000000125e7-72.dat aspack_v212_v242 behavioral31/files/0x0007000000012212-73.dat aspack_v212_v242 behavioral31/files/0x0007000000012212-74.dat aspack_v212_v242 behavioral31/files/0x00050000000125f8-78.dat aspack_v212_v242 behavioral31/files/0x00050000000125f8-77.dat aspack_v212_v242 -
Executes dropped EXE 6 IoCs
pid Process 1744 setup_installer.exe 1268 setup_install.exe 688 Tue01d702368dbba.exe 1232 Tue01d702368dbba.tmp 920 Tue01d702368dbba.exe 1668 Tue01d702368dbba.tmp -
Loads dropped DLL 26 IoCs
pid Process 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1268 setup_install.exe 1268 setup_install.exe 1268 setup_install.exe 1268 setup_install.exe 1268 setup_install.exe 1268 setup_install.exe 1268 setup_install.exe 1268 setup_install.exe 1688 cmd.exe 688 Tue01d702368dbba.exe 688 Tue01d702368dbba.exe 688 Tue01d702368dbba.exe 1232 Tue01d702368dbba.tmp 1232 Tue01d702368dbba.tmp 1232 Tue01d702368dbba.tmp 1232 Tue01d702368dbba.tmp 920 Tue01d702368dbba.exe 920 Tue01d702368dbba.exe 920 Tue01d702368dbba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 572 powershell.exe 1612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 1612 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1436 wrote to memory of 1744 1436 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 28 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1744 wrote to memory of 1268 1744 setup_installer.exe 29 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1492 1268 setup_install.exe 32 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1008 1268 setup_install.exe 31 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1688 1268 setup_install.exe 33 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1268 wrote to memory of 1636 1268 setup_install.exe 34 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1008 wrote to memory of 1612 1008 cmd.exe 37 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1492 wrote to memory of 572 1492 cmd.exe 36 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 1688 wrote to memory of 688 1688 cmd.exe 35 PID 688 wrote to memory of 1232 688 Tue01d702368dbba.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\Tue01d702368dbba.exeTue01d702368dbba.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\is-G2GC8.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-G2GC8.tmp\Tue01d702368dbba.tmp" /SL5="$4012C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\Tue01d702368dbba.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\Tue01d702368dbba.exe"C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\Tue01d702368dbba.exe" /SILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\is-9HQ2Q.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-9HQ2Q.tmp\Tue01d702368dbba.tmp" /SL5="$5012C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0D6A2556\Tue01d702368dbba.exe" /SILENT8⤵
- Executes dropped EXE
PID:1668
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0133c29150b.exe4⤵PID:1636
-
-
-