94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe
Size

134KB
MD5

5605bf937ce5fab481d4c0c5521ce601
SHA1

7e85d09e0e040eb4120f5d85d76a07f03b31a7ee
SHA256

94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963
SHA512

f8889ee6a24162e3ced971f551f9cc85ada0fb5d4442a13c0bd336f3f941372e57b3fed2553cd0cff959ad84e491d21faa193238b75bac57bea56a8542f54330
SSDEEP

3072:oalShI/cDdklJZYk34d9iTXu+bJySeVsvsKmqx:oalSkch+Wd9QXuWJyBVrP

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\cvasds0.dll	aspack_v212_v242

Loads dropped DLL 1 IoCs

Processes:

94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

pid process

1976 94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoosoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\herss.exe"	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1976 WerFault.exe 94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

pid	pid_target	process	target process
1684	1976	WerFault.exe	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

pid	process
1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe
1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe
1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe
1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe
1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe

description	pid	process	target process
PID 1976 wrote to memory of 1232	1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe	Explorer.EXE
PID 1976 wrote to memory of 1684	1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe	WerFault.exe
PID 1976 wrote to memory of 1684	1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe	WerFault.exe
PID 1976 wrote to memory of 1684	1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe	WerFault.exe
PID 1976 wrote to memory of 1684	1976	94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe	WerFault.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe
"C:\Users\Admin\AppData\Local\Temp\94290c1dab7a3849b744fad6c57870181a2f2cb9dec0758a160e8ebfdb9f1963.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 188
3⤵
- Program crash
PID:1684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cvasds0.dll
Filesize
82KB

MD5
e393c9f4fc6f18f9802f4af5a7b806d9

SHA1
b0d40891fcc7a9a13ed346b7f663db6c056ddc99

SHA256
92a7cfb73d91be0c751372c5e1ee50eb6bef6ef62baa8f5a0c018fbb1d626f1a

SHA512
ebacfbe8a05eaf01538224384bc1e403e63f6c69df8f4ec554b4abdb631cf665e6167eba84e3f7d0367cd1397aad596e4dae1ab0703382e235498528fe3b96eb

Download Submit
memory/1684-57-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1976-56-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads