beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060

Analysis

max time kernel
141s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060.exe
Size

1.8MB
MD5

e17aa1fa0d3212530122dd9a37d1604a
SHA1

a402e6ccd0ce93d040ee9aa6f0c272856dadf77a
SHA256

beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060
SHA512

7434a6d9682c2ba2d99675a9a35033d49c1a2450d28a8371ecc4ed016a345bffcdc0634cf65b1be0efaf6334ba0d928671f105741c42cb1bb379038c0d6f5533
SSDEEP

49152:0an6vpEdiukzJl8ns0dICBOlKRnVAVBIOPTl:0an6xE0uwJSs0dILKRnVAVKO

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000500000000b2d2-55.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
1468	beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1468	beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060.exe
1468	beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060.exe

C:\Users\Admin\AppData\Local\Temp\beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060.exe
"C:\Users\Admin\AppData\Local\Temp\beb287e2babe8bd8165b5c83a8480182c0a3dd91c05cc297bd236aa29a86f060.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~ad1F37.tmp

Filesize
32KB

MD5
ab052529eece519e8b05e96aa1d099a1

SHA1
43ecc18c19c2130175b0616f593fe59f945c3d69

SHA256
ea040b5ec1f76467cfdcfdf38df0ba6e03ca327b3687c65e53df023158c7b32d

SHA512
b8904916eeb8ea5569df1df3bf9ef222bf9bf9da0ae6c10dda8cff4667689304117b4f5373d4d7166c32b9171213ce63ec0245f838b0695d1858e4c0f0f1cb10

Download Submit
memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1468-56-0x0000000000400000-0x00000000005D7000-memory.dmp

Filesize
1.8MB

Download
memory/1468-57-0x0000000010000000-0x000000001059B000-memory.dmp

Filesize
5.6MB

Download
memory/1468-58-0x0000000000400000-0x00000000005D7000-memory.dmp

Filesize
1.8MB

Download