3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46

Analysis

max time kernel
152s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
Size

408KB
MD5

a0eb151575bc500d6d818371fdb964ef
SHA1

93208d5b4648fdf774bc1d6a0c856892fa3cd292
SHA256

3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46
SHA512

663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f
SSDEEP

12288:eumIwGaTYJDdSAWdFVv5gZKTe1XJiot/ro5d:3zwdUZdSAWZv5cX1t8P

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0009000000012353-60.dat	aspack_v212_v242
behavioral1/files/0x0009000000012353-61.dat	aspack_v212_v242
behavioral1/files/0x0009000000012353-63.dat	aspack_v212_v242
behavioral1/files/0x0009000000012353-70.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Deletes itself 1 IoCs

pid	Process
1960	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft MSBuild = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft MSBuild = "C:\\Program Files\\Common Files\\InstallShield\\Professional\\Microsoft 101\\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
File opened for modification	C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
File created	C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
1976	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1976	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	27
PID 1512 wrote to memory of 1976	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	27
PID 1512 wrote to memory of 1976	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	27
PID 1512 wrote to memory of 1976	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	27
PID 1512 wrote to memory of 1960	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	28
PID 1512 wrote to memory of 1960	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	28
PID 1512 wrote to memory of 1960	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	28
PID 1512 wrote to memory of 1960	1512	3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe	28

C:\Users\Admin\AppData\Local\Temp\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
"C:\Users\Admin\AppData\Local\Temp\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe
  "C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat
  2⤵
  - Deletes itself
  PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Filesize
408KB

MD5
a0eb151575bc500d6d818371fdb964ef

SHA1
93208d5b4648fdf774bc1d6a0c856892fa3cd292

SHA256
3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46

SHA512
663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f

Download Submit
C:\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Filesize
408KB

MD5
a0eb151575bc500d6d818371fdb964ef

SHA1
93208d5b4648fdf774bc1d6a0c856892fa3cd292

SHA256
3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46

SHA512
663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$WindowsXp.bat

Filesize
297B

MD5
32647e935bafd65f743663ad27d36899

SHA1
21502e4bfd250b417f239d92ffa47b68dd9f28d6

SHA256
f76429464e789d495a51fccd8c443719d6315c25c951220078c36515b8d7710e

SHA512
8c56d2f454b6e038795a7d66284d576b4273ce285fca370cdae3de4744368e6303f36689f1b85fef5d6ca1cd46ed82537b581cc5af0ab16aea7344a8491ce8d1

Download Submit
\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Filesize
408KB

MD5
a0eb151575bc500d6d818371fdb964ef

SHA1
93208d5b4648fdf774bc1d6a0c856892fa3cd292

SHA256
3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46

SHA512
663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f

Download Submit
\Program Files\Common Files\InstallShield\Professional\Microsoft 101\3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46.exe

Filesize
408KB

MD5
a0eb151575bc500d6d818371fdb964ef

SHA1
93208d5b4648fdf774bc1d6a0c856892fa3cd292

SHA256
3ce252944b41a57a7548e8837e20c3fa724fbec30a65fd8205ef6b8ff12edd46

SHA512
663d0b9d81d922d37b9ed8d0d34bf079b9583f7ad60f61c0d53e0ae4144e4295a51d1e3d7a061c698955198d1c54b743c15eea23dcac764035333babd928703f

Download Submit
memory/1512-71-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1512-59-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1512-57-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1512-58-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1512-55-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1512-72-0x0000000000630000-0x000000000063D000-memory.dmp

Filesize
52KB

Download
memory/1512-56-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1512-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1976-68-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-65-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-67-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-73-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-66-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-75-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download