Analysis
-
max time kernel
69s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe
Resource
win10v2004-20220812-en
General
-
Target
7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe
-
Size
208KB
-
MD5
938e4450488314952b040746bcfea480
-
SHA1
83597f65e8f87b08220a3869bae761c4af827b41
-
SHA256
7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4
-
SHA512
cac2696e7d70a4433327a708892047bd29bbe2e06690409a6ef4b2dda8797c1b7f981e2c09c3fd911330a9174b9b841d5742f919123fcd0bc3940c09e4be5def
-
SSDEEP
3072:N9IoYcv8MJGo5LOtJasl9cF94Yha+LwULcpL3ejaAVkuXYJnnL:BEo5qyCcn4Yw+/YOHXYJn
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000c0000000054a8-56.dat aspack_v212_v242 behavioral1/files/0x0009000000012322-64.dat aspack_v212_v242 behavioral1/files/0x000c0000000054a8-63.dat aspack_v212_v242 behavioral1/files/0x0009000000012319-70.dat aspack_v212_v242 behavioral1/files/0x0009000000012319-71.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1472 0bd21986.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 0bd21986.exe -
resource yara_rule behavioral1/files/0x000c0000000054a8-56.dat upx behavioral1/memory/1472-59-0x00000000008B0000-0x00000000008D6000-memory.dmp upx behavioral1/memory/1472-58-0x00000000008B0000-0x00000000008D6000-memory.dmp upx behavioral1/memory/1472-65-0x00000000008B0000-0x00000000008D6000-memory.dmp upx behavioral1/files/0x0009000000012322-64.dat upx behavioral1/files/0x000c0000000054a8-63.dat upx behavioral1/files/0x0009000000012319-70.dat upx behavioral1/files/0x0009000000012319-71.dat upx behavioral1/memory/1552-73-0x0000000074970000-0x0000000074996000-memory.dmp upx behavioral1/memory/1552-74-0x0000000074970000-0x0000000074996000-memory.dmp upx behavioral1/memory/1552-76-0x0000000074970000-0x0000000074996000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1472 0bd21986.exe 1552 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\375704C4.tmp 0bd21986.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 0bd21986.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1472 0bd21986.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1472 1284 7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe 28 PID 1284 wrote to memory of 1472 1284 7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe 28 PID 1284 wrote to memory of 1472 1284 7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe 28 PID 1284 wrote to memory of 1472 1284 7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe"C:\Users\Admin\AppData\Local\Temp\7c7ab2f15caaa91c1108ac3bbf334c5955fc19aa8d78e979f9d10a8accced3b4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\0bd21986.exeC:\0bd21986.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1472
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:1552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD55fc1a7fd168d8ff7329d428127451ee2
SHA11ef1777fa9ac1eb70f9473af5208d9a91a1fe1f9
SHA256cddfa0352d36b9335d39ae39c28dccf1c7ed661816b431e19ae876dc2c6636b0
SHA5126f2ec89b0ee8e26a10ed96718e4e2566725511ede4fadace5a280730ea99347b4248eac2b26e3d1cf1c1ac4be9dcb9cc8240912ab8b24173612b3daa7a47a819
-
Filesize
96KB
MD55fc1a7fd168d8ff7329d428127451ee2
SHA11ef1777fa9ac1eb70f9473af5208d9a91a1fe1f9
SHA256cddfa0352d36b9335d39ae39c28dccf1c7ed661816b431e19ae876dc2c6636b0
SHA5126f2ec89b0ee8e26a10ed96718e4e2566725511ede4fadace5a280730ea99347b4248eac2b26e3d1cf1c1ac4be9dcb9cc8240912ab8b24173612b3daa7a47a819
-
Filesize
720B
MD5ad682dbec9538d00a694f57a0a4f79f8
SHA188026951be6661daf331c02ddbd51017b91d460b
SHA256f03eab0e4720bf5f196dbf08b7ed0d26c125fdaaab8d142ae1b0ca994c4d6b54
SHA5123aed0eb637db0ac62b0b506a81c3c3c981a04defff201030f6d3fe7906c18bfa0641d1475ef61ebd4d530f85d1a3b5d61d81e21d5c9692dd647f3b3b870e9422
-
Filesize
96KB
MD5f80815ff6725e01c204d1a4d245f87e2
SHA1629779a2cf984a3e0968287b54b875e20a4dff8d
SHA2569bde7a3eff6b1d858df3aa33960b15799058673011cab8e754215064ef48522c
SHA5125b91dc8eee77d9e3deb409bd20aa0533c9cd6ee7f0256c85e6b8294d6edb344e14f10e1312e507b89fcb2df8afb4b71eaad3737435225a77c4a86d7b3ebc89ef
-
Filesize
96KB
MD5f80815ff6725e01c204d1a4d245f87e2
SHA1629779a2cf984a3e0968287b54b875e20a4dff8d
SHA2569bde7a3eff6b1d858df3aa33960b15799058673011cab8e754215064ef48522c
SHA5125b91dc8eee77d9e3deb409bd20aa0533c9cd6ee7f0256c85e6b8294d6edb344e14f10e1312e507b89fcb2df8afb4b71eaad3737435225a77c4a86d7b3ebc89ef
-
Filesize
96KB
MD5f80815ff6725e01c204d1a4d245f87e2
SHA1629779a2cf984a3e0968287b54b875e20a4dff8d
SHA2569bde7a3eff6b1d858df3aa33960b15799058673011cab8e754215064ef48522c
SHA5125b91dc8eee77d9e3deb409bd20aa0533c9cd6ee7f0256c85e6b8294d6edb344e14f10e1312e507b89fcb2df8afb4b71eaad3737435225a77c4a86d7b3ebc89ef