91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363

General

Target

91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
Size

595KB
MD5

ed0e13d01d2d233abf46942a6d454cbe
SHA1

cb920a79944b7ffb7d885f392cb9a1fe825d0502
SHA256

91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363
SHA512

69df9c3c263bfb671ea74945cc78396e723aa1c69f2b39d6367661304d41311bf92b89d309d41ba7523df5f6d12d56b15c3e50cbff1d93887c9d93690a3b24ce
SSDEEP

12288:Qv6+G3JczlR9PBQpN+qCYC1d+y7GOzSk40wYwiPvH:hF5ElRWPi4yyOeRov

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\SysWOW64\\dllcache\\ntvdame.exe,"	ntvdame.exe

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a00000001232d-56.dat	aspack_v212_v242
behavioral1/files/0x000a00000001232d-57.dat	aspack_v212_v242
behavioral1/files/0x000a00000001232d-59.dat	aspack_v212_v242
behavioral1/memory/1752-61-0x00000000005E0000-0x00000000005FD000-memory.dmp	aspack_v212_v242
behavioral1/files/0x000a00000001232d-65.dat	aspack_v212_v242
behavioral1/files/0x000800000001267d-66.dat	aspack_v212_v242
behavioral1/files/0x000800000001267d-67.dat	aspack_v212_v242
behavioral1/files/0x000800000001267d-69.dat	aspack_v212_v242
behavioral1/files/0x000800000001267d-72.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1780	3721.exe
1116	ntvdame.exe

Loads dropped DLL 4 IoCs

pid	Process
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1780	3721.exe
1780	3721.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dllcache\ntvdame.exe	3721.exe
File created	C:\Windows\SysWOW64\dllcache\ntvdame.exe	3721.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\ntvdame.exe	ntvdame.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\3721.exe	ntvdame.exe
File opened for modification	C:\Program Files\yahoo.exe	ntvdame.exe
File opened for modification	C:\Program Files\3721_.exe	ntvdame.exe
File created	C:\Program Files\3721.exe	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1780	3721.exe
1780	3721.exe
1780	3721.exe
1780	3721.exe
1780	3721.exe
1780	3721.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
Token: SeDebugPrivilege	1780	3721.exe
Token: SeDebugPrivilege	1116	ntvdame.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe
1116	ntvdame.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
1780	3721.exe
1780	3721.exe
1116	ntvdame.exe
1116	ntvdame.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1780	1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe	28
PID 1752 wrote to memory of 1780	1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe	28
PID 1752 wrote to memory of 1780	1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe	28
PID 1752 wrote to memory of 1780	1752	91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe	28
PID 1780 wrote to memory of 392	1780	3721.exe	29
PID 1780 wrote to memory of 392	1780	3721.exe	29
PID 1780 wrote to memory of 392	1780	3721.exe	29
PID 1780 wrote to memory of 392	1780	3721.exe	29
PID 1780 wrote to memory of 1116	1780	3721.exe	31
PID 1780 wrote to memory of 1116	1780	3721.exe	31
PID 1780 wrote to memory of 1116	1780	3721.exe	31
PID 1780 wrote to memory of 1116	1780	3721.exe	31
PID 1116 wrote to memory of 308	1116	ntvdame.exe	32
PID 1116 wrote to memory of 308	1116	ntvdame.exe	32
PID 1116 wrote to memory of 308	1116	ntvdame.exe	32
PID 1116 wrote to memory of 308	1116	ntvdame.exe	32

C:\Users\Admin\AppData\Local\Temp\91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe
"C:\Users\Admin\AppData\Local\Temp\91fe2293aa09da2e22fd59f9ee538ba80dbc249329b57583f66d86f280ff2363.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files\3721.exe
  "C:\Program Files\3721.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\net1.exe
    "C:\Windows\System32\net1.exe" start sharedaccess
    3⤵
    PID:392
- - C:\Windows\SysWOW64\dllcache\ntvdame.exe
    "C:\Windows\system32\dllcache\ntvdame.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\net1.exe
      "C:\Windows\System32\net1.exe" start sharedaccess
      4⤵
      PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\3721.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
C:\Program Files\3721.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
C:\Windows\SysWOW64\dllcache\ntvdame.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
C:\Windows\SysWOW64\dllcache\ntvdame.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
\Program Files\3721.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
\Program Files\3721.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
\Windows\SysWOW64\dllcache\ntvdame.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
\Windows\SysWOW64\dllcache\ntvdame.exe

Filesize
37KB

MD5
82c28e7105ef6317f1e3302c05ec638f

SHA1
caa6de74b2245a122b0d007d2d8fa0a712551a5d

SHA256
b9f6fa466a607d3c58e74fa532239cd6122c5ea8e40a35eb6e78e4a79ef111d8

SHA512
d44e19cf9085935e96650c38684edea129691abbc212bbd2d63b0c09ee35fd13003b5e89c67f976965fa72225a13588198f1635740ded728b5fe85c54c1f7b26

Download Submit
memory/1116-73-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1116-74-0x0000000074441000-0x0000000074443000-memory.dmp

Filesize
8KB

Download
memory/1116-77-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1752-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1752-62-0x00000000005E0000-0x00000000005FD000-memory.dmp

Filesize
116KB

Download
memory/1752-61-0x00000000005E0000-0x00000000005FD000-memory.dmp

Filesize
116KB

Download
memory/1752-55-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1752-75-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1752-76-0x00000000005E0000-0x00000000005FD000-memory.dmp

Filesize
116KB

Download
memory/1780-63-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing