ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba

Analysis

max time kernel
171s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 15:56 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Size

373KB
MD5

81db7c4a75845432c6465d971fc0c160
SHA1

fea0ae4caa595a9b444ace4b64f0d35b3f8b78ce
SHA256

ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba
SHA512

23464d2c56d74825238565b5855b66fd5e9dd6f4abbb2eec46020b2d966fa3ad91fc4333a51bc57d54826d383bc6139405a5a1cccf208136ed857956561ae30e
SSDEEP

6144:dcIhoZH+MWDYLZvzN5V+pOrVXl7HWrE+icB8aa36OCwb7eEk8vEE+M1P:2IhEWDYLZvEEXVHGbKaW60b7eX8vEkP

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000022e34-133.dat	aspack_v212_v242
behavioral2/files/0x0008000000022e34-134.dat	aspack_v212_v242
behavioral2/files/0x0007000000022e42-140.dat	aspack_v212_v242
behavioral2/files/0x0007000000022e42-141.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2088	4c856ba6.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	4c856ba6.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022e34-133.dat	upx
behavioral2/files/0x0008000000022e34-134.dat	upx
behavioral2/memory/2088-135-0x0000000000DD0000-0x0000000000E18000-memory.dmp	upx
behavioral2/memory/2088-137-0x0000000000DD0000-0x0000000000E18000-memory.dmp	upx
behavioral2/files/0x0007000000022e42-140.dat	upx
behavioral2/memory/392-142-0x0000000075340000-0x0000000075388000-memory.dmp	upx
behavioral2/files/0x0007000000022e42-141.dat	upx
behavioral2/memory/392-144-0x0000000075340000-0x0000000075388000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
392	Svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\6CE50B10.tmp	4c856ba6.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	4c856ba6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2088	4c856ba6.exe
2088	4c856ba6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4244	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2088	4244	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	80
PID 4244 wrote to memory of 2088	4244	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	80
PID 4244 wrote to memory of 2088	4244	ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe	80

C:\Users\Admin\AppData\Local\Temp\ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe
"C:\Users\Admin\AppData\Local\Temp\ffd2cd3152d78a2c7dd8815696095820ef52b30640dd04928165a831048e22ba.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
- C:\4c856ba6.exe
  C:\4c856ba6.exe
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
PID:392

Network

DNS

151.122.125.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

151.122.125.40.in-addr.arpa

IN PTR

Response
DNS

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

Remote address:

8.8.8.8:53

Request

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

IN PTR

Response

93.184.220.29:80

46 B
40 B
1
1
52.109.13.62:443

40 B
1
93.184.220.29:80

322 B
7
93.184.221.240:80

322 B
7
20.189.173.13:443

322 B
7
87.248.202.1:80

322 B
7
87.248.202.1:80

322 B
7
87.248.202.1:80

322 B
7
93.184.220.29:80

260 B
5

8.8.8.8:53

151.122.125.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

151.122.125.40.in-addr.arpa
8.8.8.8:53

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

dns

118 B
204 B
1
1

DNS Request

d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4c856ba6.exe

Filesize
222KB

MD5
585c2390e02463e6711265e605eff0c7

SHA1
d076affdb51cb988509555f866d576aa309cf380

SHA256
09b7625008038ff223761acf9bac6bc4794700f336b99b1d1891b58c293bb082

SHA512
c829a8b6e70dcf42f6586a8cb0026b7289db55c56d39c7f712b3e43addb7a66eb83fd89cfa39fb306edc1b3db10c0dda7d05aeceddac94fe4a393427c60277f6

Download Submit
C:\4c856ba6.exe

Filesize
222KB

MD5
585c2390e02463e6711265e605eff0c7

SHA1
d076affdb51cb988509555f866d576aa309cf380

SHA256
09b7625008038ff223761acf9bac6bc4794700f336b99b1d1891b58c293bb082

SHA512
c829a8b6e70dcf42f6586a8cb0026b7289db55c56d39c7f712b3e43addb7a66eb83fd89cfa39fb306edc1b3db10c0dda7d05aeceddac94fe4a393427c60277f6

Download Submit
C:\Users\Infotmp.txt

Filesize
724B

MD5
006395c5626bbe5c01fd2fa62e11ded7

SHA1
1a69c87cf48265cb5573262b497bc2c6cbd06733

SHA256
e46d3754e4a30a79917cec26b0efd760bfb3575c010a616625db55543c3f4600

SHA512
5f2cf3227d23dc366ec13c64148ffab1777f061b1fe17e5f32fdab9f9b9e69b30de4796c4c685934559c16ae99467fa135f4db753f3e065f1ac77551c7337367

Download Submit
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll

Filesize
222KB

MD5
eca252e84ada8d896458393bfb62d022

SHA1
5f200c89df8d196e64987c3f6b61da52dcead693

SHA256
b0037b149a64cba1f5c382cd87e5d7a5ba6bf9ed1866c3af8cbf2c7e50bb5a1e

SHA512
dba28a7af38c222699405a98f34fabec2783a5842b3573cf432e050cf8f07013bc396b081842bd0625e33b6941ed90d2463eca8c66020db237cf61104fbb7484

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
222KB

MD5
eca252e84ada8d896458393bfb62d022

SHA1
5f200c89df8d196e64987c3f6b61da52dcead693

SHA256
b0037b149a64cba1f5c382cd87e5d7a5ba6bf9ed1866c3af8cbf2c7e50bb5a1e

SHA512
dba28a7af38c222699405a98f34fabec2783a5842b3573cf432e050cf8f07013bc396b081842bd0625e33b6941ed90d2463eca8c66020db237cf61104fbb7484

Download Submit
memory/392-144-0x0000000075340000-0x0000000075388000-memory.dmp

Filesize
288KB

Download
memory/392-142-0x0000000075340000-0x0000000075388000-memory.dmp

Filesize
288KB

Download
memory/2088-135-0x0000000000DD0000-0x0000000000E18000-memory.dmp

Filesize
288KB

Download
memory/2088-139-0x0000000002DC0000-0x0000000006DC0000-memory.dmp

Filesize
64.0MB

Download
memory/2088-138-0x0000000002DC0000-0x0000000006DC0000-memory.dmp

Filesize
64.0MB

Download
memory/2088-137-0x0000000000DD0000-0x0000000000E18000-memory.dmp

Filesize
288KB

Download
memory/4244-136-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download