1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb

Analysis

max time kernel
28s
max time network
82s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe
Size

740KB
MD5

54aa282bbc67aac4d462ddc76096c106
SHA1

4cb55cdd8099ecb6cd697838ca72506bf23cac2e
SHA256

1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb
SHA512

4fc9fbc55eafbc171748e2b91751091a0b644ae9ea8f4714affd8af1e1047504b80543d981c449748ec850c6175d6a3c9be3cca75b1b9264dcff012972993ead
SSDEEP

12288:5TbEblEqvPedr2DQFN7DE9auJF+3nuBAqyvK5YISC048KZj/C6Zc492g8MhD9I7S:94blESedCDqlESxzKc4PHhD94tEMBU

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000c0000000054a8-56.dat	aspack_v212_v242
behavioral1/files/0x000c0000000054a8-58.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1612	4a1a1b42.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Windows Sidebar\sidebar.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{BC26E81A-F128-4782-8D2F-D77BD62CE0C4}\chrome_installer.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	4a1a1b42.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	4a1a1b42.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	4a1a1b42.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	4a1a1b42.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1612	2036	1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe	28
PID 2036 wrote to memory of 1612	2036	1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe	28
PID 2036 wrote to memory of 1612	2036	1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe	28
PID 2036 wrote to memory of 1612	2036	1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe	28
PID 1612 wrote to memory of 752	1612	4a1a1b42.exe	32
PID 1612 wrote to memory of 752	1612	4a1a1b42.exe	32
PID 1612 wrote to memory of 752	1612	4a1a1b42.exe	32
PID 1612 wrote to memory of 752	1612	4a1a1b42.exe	32

C:\Users\Admin\AppData\Local\Temp\1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe
"C:\Users\Admin\AppData\Local\Temp\1ad8809347eeb6fd7cd6350229a5ed9dc4b5ca97c49671188c7c86c7e1c03dcb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\4a1a1b42.exe
  C:\4a1a1b42.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\71551e75.bat" "
    3⤵
    PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4a1a1b42.exe

Filesize
15KB

MD5
e351365b4bc9f244b8424288e2cdbcbd

SHA1
f2d70670f8d230a59b453ae4cf4738e7675221a2

SHA256
d511d476b6777335ed6d1bc3ce7efdf84a91bf04a6514c263c28caec186e09ee

SHA512
263f3db3f4d4d7e4d8cfef8663ab9dbebfa3f6606c1eca0fe0fbcaa867e0980617972d1e15c888fd7c849b4d17e457e877991c55ea82c10e8033662e26520864

Download Submit
C:\4a1a1b42.exe

Filesize
15KB

MD5
e351365b4bc9f244b8424288e2cdbcbd

SHA1
f2d70670f8d230a59b453ae4cf4738e7675221a2

SHA256
d511d476b6777335ed6d1bc3ce7efdf84a91bf04a6514c263c28caec186e09ee

SHA512
263f3db3f4d4d7e4d8cfef8663ab9dbebfa3f6606c1eca0fe0fbcaa867e0980617972d1e15c888fd7c849b4d17e457e877991c55ea82c10e8033662e26520864

Download Submit
C:\Users\Admin\AppData\Local\Temp\71551e75.bat

Filesize
129B

MD5
00cf25f66c49540d827960f6fe3e5d41

SHA1
977159c97334dd818ee6066284d3423b7ee0b6d3

SHA256
e022f4ec389726e2c429e169cda0d76d29ef6d7049f27550f3ca8584b7ae4d10

SHA512
d7e7e6a674b8147eb06bd1d2ea3f0f10837c39499a72f0275f49ef3db5b78bac7d48b5fb6ec119cb16db6295299b59d65f561ff9a42acad8eb459df92e26095e

Download Submit
memory/1612-62-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1612-71-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/2036-63-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2036-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/2036-64-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2036-65-0x0000000000400000-0x0000000000604000-memory.dmp

Filesize
2.0MB

Download
memory/2036-66-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2036-67-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2036-69-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2036-68-0x0000000000400000-0x0000000000604000-memory.dmp

Filesize
2.0MB

Download
memory/2036-61-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2036-60-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2036-59-0x0000000000400000-0x0000000000604000-memory.dmp

Filesize
2.0MB

Download