98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a

Analysis

max time kernel
4294181s
max time network
126s
platform
windows7_x64
resource
win7-20220310-en
submitted
12-03-2022 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
Size

3.2MB
MD5

1d803235e19095cb252cb3e0bb5c8756
SHA1

706ba4dcb4696b91a762cbadcd70da0076346f74
SHA256

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a
SHA512

a8ef75d034443469170df8f54ba5797340e50a07b8fe62bab42c39639f6b85383430fede1af6ca6241c29efce351348c3372401419e2a3fb5db3a6f93cf167ca

Score

9^/10

aspackv2 upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Program Files\Common Files\System\symsrv.dll	acprotect

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurl.dll	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

setup_install.exe

pid process

924 setup_install.exe

pid	process
924	setup_install.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Program Files\Common Files\System\symsrv.dll	upx

Loads dropped DLL 7 IoCs

Processes:

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exesetup_install.exe

pid	process
1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
924	setup_install.exe
924	setup_install.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description ioc process

File opened (read-only) \??\e: 98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
Drops file in Program Files directory 1 IoCs

Processes:

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description ioc process

File created C:\Program Files\Common Files\System\symsrv.dll 98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

pid process

1564 98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description pid process

Token: SeDebugPrivilege 1564 98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description	ioc	process
File opened (read-only)	\??\e:	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\symsrv.dll	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description	pid	process
Token: SeDebugPrivilege	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe

description	pid	process	target process
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe
PID 1564 wrote to memory of 924	1564	98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe	setup_install.exe

C:\Users\Admin\AppData\Local\Temp\98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe
"C:\Users\Admin\AppData\Local\Temp\98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe
MD5
87b375cb03f906fa96816a8523f6742a

SHA1
0ee23613b38337bea2af3758f664b00acb933317

SHA256
108d29300c13545d472cb95948888b6bd92790f206b4e5d66667cfe2c6c634e3

SHA512
26204ed5acf9a072d21254189eaaf9c36c512c04b3ef2cc31a52aa2fe84936c69275c4dad0c1a6362fb1a6b1f749677095becc26240223b2dbbf4074192ec8de

Download Submit
\Program Files\Common Files\System\symsrv.dll
MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\libgcc_s_dw2-1.dll.tmp
MD5
deaeaac7d0fabeb1943e166f4e91df03

SHA1
f6c81919cc2c38dcd8728b9e81151870d6fbc5ee

SHA256
51272aaf2333819cec89a3bf0540c2314561ed73296264bba3cde20036e8b582

SHA512
b9cdb6fc551cbf0b80a5bf9c3aff6456e12efc89fcbaa4e1ada2bf60e5c05e67d54ef55b14355b97fb27676ac5b4086359926d80a5325e66a401b503fe86bd37

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe
MD5
87b375cb03f906fa96816a8523f6742a

SHA1
0ee23613b38337bea2af3758f664b00acb933317

SHA256
108d29300c13545d472cb95948888b6bd92790f206b4e5d66667cfe2c6c634e3

SHA512
26204ed5acf9a072d21254189eaaf9c36c512c04b3ef2cc31a52aa2fe84936c69275c4dad0c1a6362fb1a6b1f749677095becc26240223b2dbbf4074192ec8de

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe
MD5
87b375cb03f906fa96816a8523f6742a

SHA1
0ee23613b38337bea2af3758f664b00acb933317

SHA256
108d29300c13545d472cb95948888b6bd92790f206b4e5d66667cfe2c6c634e3

SHA512
26204ed5acf9a072d21254189eaaf9c36c512c04b3ef2cc31a52aa2fe84936c69275c4dad0c1a6362fb1a6b1f749677095becc26240223b2dbbf4074192ec8de

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC16C9E76\setup_install.exe
MD5
87b375cb03f906fa96816a8523f6742a

SHA1
0ee23613b38337bea2af3758f664b00acb933317

SHA256
108d29300c13545d472cb95948888b6bd92790f206b4e5d66667cfe2c6c634e3

SHA512
26204ed5acf9a072d21254189eaaf9c36c512c04b3ef2cc31a52aa2fe84936c69275c4dad0c1a6362fb1a6b1f749677095becc26240223b2dbbf4074192ec8de

Download Submit
memory/924-66-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/924-68-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/924-67-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1564-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1564-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download