c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d

Analysis

max time kernel
101s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
Size

1014KB
MD5

93ec591bcd108f1e21d5426348295410
SHA1

f9eb7085bf72b5dab61eeaed832975ff51a24c9c
SHA256

c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d
SHA512

9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a
SSDEEP

24576:y969NTTlWa8vuj18D384lX6sGkbQLmIQoTDYbu4sH+D:y96nTJWasuj18DMARrQLmIQyL4sH+

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b000000022f36-139.dat	aspack_v212_v242
behavioral2/files/0x000b000000022f36-138.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4472	bRC.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
4924	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4472	4924	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	82
PID 4924 wrote to memory of 4472	4924	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	82
PID 4924 wrote to memory of 4472	4924	c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe	82

C:\Users\Admin\AppData\Local\Temp\c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe
"C:\Users\Admin\AppData\Local\Temp\c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe"
  2⤵
  - Executes dropped EXE
  PID:4472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe

Filesize
1014KB

MD5
93ec591bcd108f1e21d5426348295410

SHA1
f9eb7085bf72b5dab61eeaed832975ff51a24c9c

SHA256
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d

SHA512
9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bRC.exe

Filesize
1014KB

MD5
93ec591bcd108f1e21d5426348295410

SHA1
f9eb7085bf72b5dab61eeaed832975ff51a24c9c

SHA256
c9fe9e30944e70f6e5ec9ab822320e854cd0a5333b2ba0533ef0e8f082b82a2d

SHA512
9a304354967eb0baf90cbb638d1c64d4f7f72111b15d9ada556822bc0ce8eee0b50310ccdb65011c4a075496eb00ac4eb1b65f45c9ca7f325fa5e2515223150a

Download Submit
memory/4472-140-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4472-141-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4472-143-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4472-142-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4472-144-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4472-146-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4924-135-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4924-136-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4924-133-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4924-134-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4924-132-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/4924-145-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download