c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d

Analysis

max time kernel
147s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
Size

1014KB
MD5

93ec591bcd108f1e21d5426348295410
SHA1

f9eb7085bf72b5dab61eeaed832975ff51a24c9c
SHA256

c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d
SHA512

9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a
SSDEEP

24576:y969NTTlWa8vuj18D384lX6sGkbQLmIQoTDYbu4sH+D:y96nTJWasuj18DMARrQLmIQyL4sH+

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000c0000000054a8-59.dat	aspack_v212_v242
behavioral1/files/0x000c0000000054a8-61.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1892	bRC.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe

Loads dropped DLL 1 IoCs

pid	Process
968	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
968	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1892	968	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	28
PID 968 wrote to memory of 1892	968	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	28
PID 968 wrote to memory of 1892	968	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	28
PID 968 wrote to memory of 1892	968	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	28

C:\Users\Admin\AppData\Local\Temp\c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
"C:\Users\Admin\AppData\Local\Temp\c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe"
  2⤵
  - Executes dropped EXE
  PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe

Filesize
1014KB

MD5
93ec591bcd108f1e21d5426348295410

SHA1
f9eb7085bf72b5dab61eeaed832975ff51a24c9c

SHA256
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d

SHA512
9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe

Filesize
1014KB

MD5
93ec591bcd108f1e21d5426348295410

SHA1
f9eb7085bf72b5dab61eeaed832975ff51a24c9c

SHA256
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d

SHA512
9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a

Download Submit
memory/968-68-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download
memory/968-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/968-58-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/968-57-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/968-56-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/968-55-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/968-71-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/968-69-0x0000000003550000-0x0000000003804000-memory.dmp

Filesize
2.7MB

Download
memory/968-66-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1892-67-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1892-65-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1892-64-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1892-70-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1892-63-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/1892-72-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download