ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba

General

Target

ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Size

373KB
MD5

81db7c4a75845432c6465d971fc0c160
SHA1

fea0ae4caa595a9b444ace4b64f0d35b3f8b78ce
SHA256

ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba
SHA512

23464d2c56d74825238565b5855b66fd5e9dd6f4abbb2eec46020b2d966fa3ad91fc4333a51bc57d54826d383bc6139405a5a1cccf208136ed857956561ae30e
SSDEEP

6144:dcIhoZH+MWDYLZvzN5V+pOrVXl7HWrE+icB8aa36OCwb7eEk8vEE+M1P:2IhEWDYLZvEEXVHGbKaW60b7eX8vEkP

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	aspack_v212_v242
behavioral1/files/0x00140000000054ab-58.dat	aspack_v212_v242
behavioral1/files/0x0007000000014124-60.dat	aspack_v212_v242
behavioral1/files/0x0008000000013a13-70.dat	aspack_v212_v242
behavioral1/files/0x0008000000013a13-71.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1408	4c856ba6.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	4c856ba6.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-58.dat	upx
behavioral1/memory/1408-59-0x0000000000250000-0x0000000000298000-memory.dmp	upx
behavioral1/files/0x0007000000014124-60.dat	upx
behavioral1/memory/1408-65-0x0000000000250000-0x0000000000298000-memory.dmp	upx
behavioral1/files/0x0008000000013a13-70.dat	upx
behavioral1/files/0x0008000000013a13-71.dat	upx
behavioral1/memory/960-73-0x00000000741F0000-0x0000000074238000-memory.dmp	upx
behavioral1/memory/960-75-0x00000000741F0000-0x0000000074238000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1408	4c856ba6.exe
960	Svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\4E8604E8.tmp	4c856ba6.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	4c856ba6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1408	4c856ba6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27
PID 2036 wrote to memory of 1408	2036	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	27

C:\Users\Admin\AppData\Local\Temp\ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
"C:\Users\Admin\AppData\Local\Temp\ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\4c856ba6.exe
  C:\4c856ba6.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4c856ba6.exe

Filesize
222KB

MD5
585c2390e02463e6711265e605eff0c7

SHA1
d076affdb51cb988509555f866d576aa309cf380

SHA256
09b7625008038ff223761acf9bac6bc4794700f336b99b1d1891b58c293bb082

SHA512
c829a8b6e70dcf42f6586a8cb0026b7289db55c56d39c7f712b3e43addb7a66eb83fd89cfa39fb306edc1b3db10c0dda7d05aeceddac94fe4a393427c60277f6

Download Submit
C:\4c856ba6.exe

Filesize
222KB

MD5
585c2390e02463e6711265e605eff0c7

SHA1
d076affdb51cb988509555f866d576aa309cf380

SHA256
09b7625008038ff223761acf9bac6bc4794700f336b99b1d1891b58c293bb082

SHA512
c829a8b6e70dcf42f6586a8cb0026b7289db55c56d39c7f712b3e43addb7a66eb83fd89cfa39fb306edc1b3db10c0dda7d05aeceddac94fe4a393427c60277f6

Download Submit
C:\Users\Infotmp.txt

Filesize
724B

MD5
2f5bb8c7342cebd28b6d35531e6fd835

SHA1
a05ee68662b96511a085a2bf8b17b5e9b85313e9

SHA256
e5c454669146f6d91cf76b7e574c6ac2aa571b4a34e57bf238a92051e9012155

SHA512
cbb82a82747c477e8d4a53f56afae66bbe18ce80cdd77d282303c7ada2c465bcfeac243a64670ad40a571670c3ced408465b1925d272d237bd73704d3f505b6e

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
222KB

MD5
eca252e84ada8d896458393bfb62d022

SHA1
5f200c89df8d196e64987c3f6b61da52dcead693

SHA256
b0037b149a64cba1f5c382cd87e5d7a5ba6bf9ed1866c3af8cbf2c7e50bb5a1e

SHA512
dba28a7af38c222699405a98f34fabec2783a5842b3573cf432e050cf8f07013bc396b081842bd0625e33b6941ed90d2463eca8c66020db237cf61104fbb7484

Download Submit
\Windows\SysWOW64\4E8604E8.tmp

Filesize
222KB

MD5
eca252e84ada8d896458393bfb62d022

SHA1
5f200c89df8d196e64987c3f6b61da52dcead693

SHA256
b0037b149a64cba1f5c382cd87e5d7a5ba6bf9ed1866c3af8cbf2c7e50bb5a1e

SHA512
dba28a7af38c222699405a98f34fabec2783a5842b3573cf432e050cf8f07013bc396b081842bd0625e33b6941ed90d2463eca8c66020db237cf61104fbb7484

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
222KB

MD5
eca252e84ada8d896458393bfb62d022

SHA1
5f200c89df8d196e64987c3f6b61da52dcead693

SHA256
b0037b149a64cba1f5c382cd87e5d7a5ba6bf9ed1866c3af8cbf2c7e50bb5a1e

SHA512
dba28a7af38c222699405a98f34fabec2783a5842b3573cf432e050cf8f07013bc396b081842bd0625e33b6941ed90d2463eca8c66020db237cf61104fbb7484

Download Submit
memory/960-75-0x00000000741F0000-0x0000000074238000-memory.dmp

Filesize
288KB

Download
memory/960-73-0x00000000741F0000-0x0000000074238000-memory.dmp

Filesize
288KB

Download
memory/1408-68-0x00000000741F0000-0x0000000074238000-memory.dmp

Filesize
288KB

Download
memory/1408-59-0x0000000000250000-0x0000000000298000-memory.dmp

Filesize
288KB

Download
memory/1408-65-0x0000000000250000-0x0000000000298000-memory.dmp

Filesize
288KB

Download
memory/1408-66-0x0000000002040000-0x0000000006040000-memory.dmp

Filesize
64.0MB

Download
memory/1408-67-0x00000000757C0000-0x0000000075820000-memory.dmp

Filesize
384KB

Download
memory/1408-76-0x00000000757C0000-0x0000000075820000-memory.dmp

Filesize
384KB

Download
memory/1408-69-0x0000000002040000-0x0000000006040000-memory.dmp

Filesize
64.0MB

Download
memory/2036-64-0x0000000000470000-0x00000000004B8000-memory.dmp

Filesize
288KB

Download
memory/2036-62-0x0000000000470000-0x00000000004D1000-memory.dmp

Filesize
388KB

Download
memory/2036-63-0x0000000000470000-0x00000000004B8000-memory.dmp

Filesize
288KB

Download
memory/2036-61-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2036-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/2036-77-0x0000000074091000-0x0000000074093000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing