9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79

Analysis

max time kernel
42s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe
Size

452KB
MD5

8de5f463a3b9d225d18de39170a393bb
SHA1

d579b2b74fa5349b8b470d9fdb5f2e7d0a59acc5
SHA256

9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79
SHA512

58ea3d12578fe2b436fe8f0cd8f3a182df96472087598dc6a3b76e087993e21423089530fcd0e7f4f993fd8efdbcfaa5784d1043d4fc2e440c6be39c3a30ae5f
SSDEEP

12288:pIyFl7J8QgMF+T7EMGpt5iHbGNkC7hvKX12nh:NCTTNCt26m12nh

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00090000000122fa-60.dat	aspack_v212_v242
behavioral1/files/0x00090000000122fa-62.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
564	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MS Office = "C:\\Windows\\msconfig.exe"	WScript.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\msconfig.exe	WScript.exe
File opened for modification	C:\Windows\msconfig.exe	WScript.exe
File created	C:\Windows\svchost.exe	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1492	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	28
PID 628 wrote to memory of 1492	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	28
PID 628 wrote to memory of 1492	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	28
PID 628 wrote to memory of 1492	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	28
PID 628 wrote to memory of 564	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	29
PID 628 wrote to memory of 564	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	29
PID 628 wrote to memory of 564	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	29
PID 628 wrote to memory of 564	628	9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe	29

C:\Users\Admin\AppData\Local\Temp\9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe
"C:\Users\Admin\AppData\Local\Temp\9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zzzzz.vbs"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:1492
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zzzzz.vbs

Filesize
445B

MD5
996d83ae740392fb8c6f34e6e4827051

SHA1
787289d5adf8c2d20dbd6f17dd507884a3ca98a5

SHA256
9b8f8a7206cfe7193b10dced0458a74ebdc5151d59b8a331b5c64e6235a49d39

SHA512
0d20badc45b1b3cdc3515b4587e4e7e287059b418b980f6dfa0ae3692042005f27b0abe2ed33a8d4c819d54ea2343f07a6d925b88d27fb547b23cdecbe29ad8a

Download Submit
C:\Windows\svchost.exe

Filesize
452KB

MD5
8de5f463a3b9d225d18de39170a393bb

SHA1
d579b2b74fa5349b8b470d9fdb5f2e7d0a59acc5

SHA256
9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79

SHA512
58ea3d12578fe2b436fe8f0cd8f3a182df96472087598dc6a3b76e087993e21423089530fcd0e7f4f993fd8efdbcfaa5784d1043d4fc2e440c6be39c3a30ae5f

Download Submit
C:\Windows\svchost.exe

Filesize
452KB

MD5
8de5f463a3b9d225d18de39170a393bb

SHA1
d579b2b74fa5349b8b470d9fdb5f2e7d0a59acc5

SHA256
9d40df1a75fe474a3f9d5fdc4685f9f614616dfbe52323c8941b8fb53b9d7c79

SHA512
58ea3d12578fe2b436fe8f0cd8f3a182df96472087598dc6a3b76e087993e21423089530fcd0e7f4f993fd8efdbcfaa5784d1043d4fc2e440c6be39c3a30ae5f

Download Submit
memory/564-63-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/564-66-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/628-54-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/628-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/628-59-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/628-65-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download