Analysis

  • max time kernel
    62s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 22:54

General

  • Target

    e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe

  • Size

    96KB

  • MD5

    a15a69ec30f76f8c09f30de72645ad20

  • SHA1

    0cf7f000f314ab0c7f8413174f6c4f07b06ec50e

  • SHA256

    e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275

  • SHA512

    0ab2a4bee56f7ad5c8dea414b641be56ae8a0b0420846e0c689ba01d3099eed106a43ebcba281b60b26849b279450d20989eb34cfc86ce7efe44b43120581b45

  • SSDEEP

    1536:MqPjvlpp/06w6Px9+3cu9V+gKk6GCq2iW7z:MqPL1/7w6ZAs+VBK3GCH

Score
8/10

Malware Config

Signatures

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe
    "C:\Users\Admin\AppData\Local\Temp\e2f9711bf1e4c23929bf93cee238235b94d89f4aa902ba537b179d63a0d5f275.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\jQdkri.exe
      C:\Users\Admin\AppData\Local\Temp\jQdkri.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\200b6d33.bat" "
        3⤵
          PID:1628

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\200b6d33.bat

      Filesize

      187B

      MD5

      7ac40da050e0a9707c60ead82880af6d

      SHA1

      a0a707013056b9420d1182b2001c6c6c9a8efceb

      SHA256

      a4625d6f5ffd30f37c6c7167d840e189fdd90f7e03cecb1b17b0ebb0ae62c801

      SHA512

      7cd198f647daa25e92072c14a2c7b99683cb2f1109925db57e2f939aecdb42b029de4f9b0e506059afcb0ec1497ae62d4e234075fa6cb02eba480ad7c5cbcf7a

    • C:\Users\Admin\AppData\Local\Temp\jQdkri.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • C:\Users\Admin\AppData\Local\Temp\jQdkri.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • \Users\Admin\AppData\Local\Temp\jQdkri.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • \Users\Admin\AppData\Local\Temp\jQdkri.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • memory/836-60-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/836-61-0x0000000000170000-0x0000000000179000-memory.dmp

      Filesize

      36KB

    • memory/836-62-0x0000000000170000-0x0000000000179000-memory.dmp

      Filesize

      36KB

    • memory/836-64-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/1960-58-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

      Filesize

      8KB

    • memory/1960-63-0x0000000001260000-0x0000000001269000-memory.dmp

      Filesize

      36KB

    • memory/1960-66-0x0000000001260000-0x0000000001269000-memory.dmp

      Filesize

      36KB