0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe
Size

537KB
MD5

a3b5ac0e8c67d89e4d0462bf264fb4f8
SHA1

1e53ab57282fd815de57774395b5cafadb024ded
SHA256

0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731
SHA512

c5c89f598c8747cec5e2d7a4b2e8353854b4a62708bdca241e7d83ee7763a467f244a4556f1b01cc3d5aea48bc3c6e78fc90e6067e11efefdea669ba3fdb2a57
SSDEEP

12288:sSorh+hQ26AYBld5/s/G5v2RKV2AJRTOcTEfFjXEckdvs:sSohOZ6AYTdBs2v2RytAVXrkd0

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000022e09-134.dat	aspack_v212_v242
behavioral2/files/0x0007000000022e09-133.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
4916	KeyGen.exe
4836	1234.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	4836	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2432	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4836	1234.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 4916	336	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe	81
PID 336 wrote to memory of 4916	336	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe	81
PID 336 wrote to memory of 4916	336	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe	81
PID 336 wrote to memory of 4836	336	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe	82
PID 336 wrote to memory of 4836	336	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe	82
PID 336 wrote to memory of 4836	336	0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe	82

C:\Users\Admin\AppData\Local\Temp\0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe
"C:\Users\Admin\AppData\Local\Temp\0f033eb7df26843e8fc56d9b0e6affd9ac124c7d8200f82bc5296196d2bce731.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\KeyGen.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGen.exe"
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 468
    3⤵
    - Program crash
    PID:1744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4836 -ip 4836
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1234.exe

Filesize
488KB

MD5
31849732db31402c9bad435cf3941af9

SHA1
b9520c2470d2a32dc5e78ba377fb924d871fb43f

SHA256
ccf8570f8cc95e0c5c12ed9625bf62b39ade884e4a89153bccd0c8f1254bb696

SHA512
a6001db3badf6fdc35a5b0f7b14793946aa00a5c1c1a3e3631b06e5b12bd957f4017b746c47cbca4803100a3de5eac872f3870907ff16a8f7da1b7be9a243ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1234.exe

Filesize
488KB

MD5
31849732db31402c9bad435cf3941af9

SHA1
b9520c2470d2a32dc5e78ba377fb924d871fb43f

SHA256
ccf8570f8cc95e0c5c12ed9625bf62b39ade884e4a89153bccd0c8f1254bb696

SHA512
a6001db3badf6fdc35a5b0f7b14793946aa00a5c1c1a3e3631b06e5b12bd957f4017b746c47cbca4803100a3de5eac872f3870907ff16a8f7da1b7be9a243ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGen.exe

Filesize
94KB

MD5
e3e768d64892e65bfce6babfe52f2620

SHA1
2dbb1794757e44abb2a2f67cbfeb7b6567f8d9fc

SHA256
d2caf76e6b6c2a7780367ab5afc51419831441ebd4e4c52b07a926e5bc10deff

SHA512
a3914f860ede177292258362732e2aa67b590dde890cde5bd66efaa84df326f8f0ff1fd1fcb3eab90b03b4404c176374e68bde6c99270f23e4f6e83842e7692e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGen.exe

Filesize
94KB

MD5
e3e768d64892e65bfce6babfe52f2620

SHA1
2dbb1794757e44abb2a2f67cbfeb7b6567f8d9fc

SHA256
d2caf76e6b6c2a7780367ab5afc51419831441ebd4e4c52b07a926e5bc10deff

SHA512
a3914f860ede177292258362732e2aa67b590dde890cde5bd66efaa84df326f8f0ff1fd1fcb3eab90b03b4404c176374e68bde6c99270f23e4f6e83842e7692e

Download Submit