Analysis

  • max time kernel
    69s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 02:28

General

  • Target

    7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe

  • Size

    208KB

  • MD5

    938e4450488314952b040746bcfea480

  • SHA1

    83597f65e8f87b08220a3869bae761c4af827b41

  • SHA256

    7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4

  • SHA512

    cac2696e7d70a4433327a708892047bd29bbe2e06690409a6ef4b2dda8797c1b7f981e2c09c3fd911330a9174b9b841d5742f919123fcd0bc3940c09e4be5def

  • SSDEEP

    3072:N9IoYcv8MJGo5LOtJasl9cF94Yha+LwULcpL3ejaAVkuXYJnnL:BEo5qyCcn4Yw+/YOHXYJn

Malware Config

Signatures

  • ASPack v2.12-2.42 5 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe
    "C:\Users\Admin\AppData\Local\Temp\7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\0bd21986.exe
      C:\0bd21986.exe
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1472
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1552

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\0bd21986.exe

          Filesize

          96KB

          MD5

          5fc1a7fd168d8ff7329d428127451ee2

          SHA1

          1ef1777fa9ac1eb70f9473af5208d9a91a1fe1f9

          SHA256

          cddfa0352d36b9335d39ae39c28dccf1c7ed661816b431e19ae876dc2c6636b0

          SHA512

          6f2ec89b0ee8e26a10ed96718e4e2566725511ede4fadace5a280730ea99347b4248eac2b26e3d1cf1c1ac4be9dcb9cc8240912ab8b24173612b3daa7a47a819

        • C:\0bd21986.exe

          Filesize

          96KB

          MD5

          5fc1a7fd168d8ff7329d428127451ee2

          SHA1

          1ef1777fa9ac1eb70f9473af5208d9a91a1fe1f9

          SHA256

          cddfa0352d36b9335d39ae39c28dccf1c7ed661816b431e19ae876dc2c6636b0

          SHA512

          6f2ec89b0ee8e26a10ed96718e4e2566725511ede4fadace5a280730ea99347b4248eac2b26e3d1cf1c1ac4be9dcb9cc8240912ab8b24173612b3daa7a47a819

        • C:\Users\Infotmp.txt

          Filesize

          720B

          MD5

          ad682dbec9538d00a694f57a0a4f79f8

          SHA1

          88026951be6661daf331c02ddbd51017b91d460b

          SHA256

          f03eab0e4720bf5f196dbf08b7ed0d26c125fdaaab8d142ae1b0ca994c4d6b54

          SHA512

          3aed0eb637db0ac62b0b506a81c3c3c981a04defff201030f6d3fe7906c18bfa0641d1475ef61ebd4d530f85d1a3b5d61d81e21d5c9692dd647f3b3b870e9422

        • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

          Filesize

          96KB

          MD5

          f80815ff6725e01c204d1a4d245f87e2

          SHA1

          629779a2cf984a3e0968287b54b875e20a4dff8d

          SHA256

          9bde7a3eff6b1d858df3aa33960b15799058673011cab8e754215064ef48522c

          SHA512

          5b91dc8eee77d9e3deb409bd20aa0533c9cd6ee7f0256c85e6b8294d6edb344e14f10e1312e507b89fcb2df8afb4b71eaad3737435225a77c4a86d7b3ebc89ef

        • \Windows\SysWOW64\375704C4.tmp

          Filesize

          96KB

          MD5

          f80815ff6725e01c204d1a4d245f87e2

          SHA1

          629779a2cf984a3e0968287b54b875e20a4dff8d

          SHA256

          9bde7a3eff6b1d858df3aa33960b15799058673011cab8e754215064ef48522c

          SHA512

          5b91dc8eee77d9e3deb409bd20aa0533c9cd6ee7f0256c85e6b8294d6edb344e14f10e1312e507b89fcb2df8afb4b71eaad3737435225a77c4a86d7b3ebc89ef

        • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

          Filesize

          96KB

          MD5

          f80815ff6725e01c204d1a4d245f87e2

          SHA1

          629779a2cf984a3e0968287b54b875e20a4dff8d

          SHA256

          9bde7a3eff6b1d858df3aa33960b15799058673011cab8e754215064ef48522c

          SHA512

          5b91dc8eee77d9e3deb409bd20aa0533c9cd6ee7f0256c85e6b8294d6edb344e14f10e1312e507b89fcb2df8afb4b71eaad3737435225a77c4a86d7b3ebc89ef

        • memory/1284-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

          Filesize

          8KB

        • memory/1284-78-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/1284-79-0x0000000000220000-0x0000000000226000-memory.dmp

          Filesize

          24KB

        • memory/1284-60-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/1284-62-0x0000000000220000-0x0000000000246000-memory.dmp

          Filesize

          152KB

        • memory/1284-61-0x0000000000220000-0x0000000000246000-memory.dmp

          Filesize

          152KB

        • memory/1472-67-0x0000000001CE0000-0x0000000005CE0000-memory.dmp

          Filesize

          64.0MB

        • memory/1472-68-0x0000000075250000-0x00000000752B0000-memory.dmp

          Filesize

          384KB

        • memory/1472-69-0x0000000001CE0000-0x0000000005CE0000-memory.dmp

          Filesize

          64.0MB

        • memory/1472-66-0x0000000074A20000-0x0000000074A46000-memory.dmp

          Filesize

          152KB

        • memory/1472-65-0x00000000008B0000-0x00000000008D6000-memory.dmp

          Filesize

          152KB

        • memory/1472-58-0x00000000008B0000-0x00000000008D6000-memory.dmp

          Filesize

          152KB

        • memory/1472-77-0x0000000075250000-0x00000000752B0000-memory.dmp

          Filesize

          384KB

        • memory/1472-59-0x00000000008B0000-0x00000000008D6000-memory.dmp

          Filesize

          152KB

        • memory/1552-73-0x0000000074970000-0x0000000074996000-memory.dmp

          Filesize

          152KB

        • memory/1552-74-0x0000000074970000-0x0000000074996000-memory.dmp

          Filesize

          152KB

        • memory/1552-76-0x0000000074970000-0x0000000074996000-memory.dmp

          Filesize

          152KB