90cf664447be014f56a06be66e6415eeb82be163c4ee82b2a5b51b2cf4acda01

Analysis

max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Combo converter/Combo converter.exe
Size

1.4MB
MD5

21a1be8ee5ac2cb4d6c495e3f2a11988
SHA1

55ab37e7d64027e850f766d3c4ad7e922665258b
SHA256

a587b498226f29adf92b33bc3022ae5a0d34816b82e85ba0d1a1d2b32d366f5a
SHA512

256c54c2e227dacfab39ff464219618ffdeb069c535a3fc25d174709d5bf90a8c9d04b84d24fc2b13d8cdd69c12a09bd31f39312354fd3856aa150b92a024876
SSDEEP

24576:Fq4HJsNipd4XJ6nxK9RPnvobuDwTuz6FDR47ElnUOwqKt/Kv:FjHJ+ipdaJ6ynAbRNRLnUOwqKl0

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0003000000000729-141.dat	aspack_v212_v242
behavioral1/files/0x0003000000000729-143.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Combo converter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 6 IoCs

pid	Process
4764	Setup.exe
1348	Setup.exe
4892	Combo converter .exe
4488	svchost.exe
448	svchost.exe
4268	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	Setup.exe
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\AppXli0oiclsgg7xhw5f2e47phfbnl1gx2y7\Shell\Open	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\AppXli0oiclsgg7xhw5f2e47phfbnl1gx2y7\Shell\Open\command\ = "cmd /c PowerShell.exe -windowstyle hidden Set-MpPreference -ExclusionPath C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ms-settings\CurVer	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\AppXli0oiclsgg7xhw5f2e47phfbnl1gx2y7\Shell\Open\command	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\AppXli0oiclsgg7xhw5f2e47phfbnl1gx2y7	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\AppXli0oiclsgg7xhw5f2e47phfbnl1gx2y7\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ms-settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ms-settings\CurVer\ = "AppXli0oiclsgg7xhw5f2e47phfbnl1gx2y7"	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	svchost.exe
Token: SeDebugPrivilege	4488	svchost.exe
Token: SeDebugPrivilege	2732	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	Combo converter .exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4764	4108	Combo converter.exe	80
PID 4108 wrote to memory of 4764	4108	Combo converter.exe	80
PID 4108 wrote to memory of 1348	4108	Combo converter.exe	81
PID 4108 wrote to memory of 1348	4108	Combo converter.exe	81
PID 4108 wrote to memory of 4892	4108	Combo converter.exe	82
PID 4108 wrote to memory of 4892	4108	Combo converter.exe	82
PID 4108 wrote to memory of 4892	4108	Combo converter.exe	82
PID 1348 wrote to memory of 4488	1348	Setup.exe	83
PID 1348 wrote to memory of 4488	1348	Setup.exe	83
PID 4764 wrote to memory of 448	4764	Setup.exe	84
PID 4764 wrote to memory of 448	4764	Setup.exe	84
PID 4488 wrote to memory of 4268	4488	svchost.exe	91
PID 4488 wrote to memory of 4268	4488	svchost.exe	91
PID 4268 wrote to memory of 1876	4268	explorer.exe	92
PID 4268 wrote to memory of 1876	4268	explorer.exe	92
PID 1876 wrote to memory of 1312	1876	fodhelper.exe	94
PID 1876 wrote to memory of 1312	1876	fodhelper.exe	94
PID 1312 wrote to memory of 2732	1312	cmd.exe	96
PID 1312 wrote to memory of 2732	1312	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Combo converter\Combo converter.exe
"C:\Users\Admin\AppData\Local\Temp\Combo converter\Combo converter.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\windows\system32\fodhelper.exe
        
        "C:\windows\system32\fodhelper.exe"
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c PowerShell.exe -windowstyle hidden Set-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -windowstyle hidden Set-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
- C:\Users\Admin\AppData\Local\Temp\Combo converter\Combo converter .exe
  "C:\Users\Admin\AppData\Local\Temp\Combo converter\Combo converter .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.log

Filesize
408B

MD5
70f08e6585ed9994d97a4c71472fccd8

SHA1
3f44494d4747c87fb8b94bb153c3a3d717f9fd63

SHA256
87fbf339c47e259826080aa2dcbdf371ea47a50eec88222c6e64a92906cb37fa

SHA512
d381aec2ea869f3b2d06497e934c7fe993df6deac719370bd74310a29e8e48b6497559922d2cb44ace97c4bd7ad00eae8fe92a31081f2119de3ddbb5988af388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchost.exe.log

Filesize
588B

MD5
2f142977932b7837fa1cc70278e53361

SHA1
0a3212d221079671bfdeee176ad841e6f15904fc

SHA256
961ca2c0e803a7201adb3b656ed3abafc259d6d376e8ade66f0afff10a564820

SHA512
a25e45e41933902bcc0ea38b4daa64e96cbcd8900b446e1326cffb8c91eb1886b1e90686190bdba30d7014490001a732f91f2869bb9987c0213a8d798c7b3421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Combo converter\Combo converter .exe

Filesize
948KB

MD5
ec12db127d51cb3d21de4c5c0e9c85e7

SHA1
44f43d3fcf84bcf99da42ae987de4d3650a4e369

SHA256
06aedff3cf371b4cb71bea5c514a9256d12f223f7c2ec45919f9763c52cbbd30

SHA512
a70b83d5dee732ed16bdc763c15aece9de08c30aac3a6cad7b9c70985bd747bff4d89e83ec576f0b0ee1d1f0c469426c23e93fe03ef32ed873b0415fdb1ec43a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Combo converter\Combo converter .exe

Filesize
948KB

MD5
ec12db127d51cb3d21de4c5c0e9c85e7

SHA1
44f43d3fcf84bcf99da42ae987de4d3650a4e369

SHA256
06aedff3cf371b4cb71bea5c514a9256d12f223f7c2ec45919f9763c52cbbd30

SHA512
a70b83d5dee732ed16bdc763c15aece9de08c30aac3a6cad7b9c70985bd747bff4d89e83ec576f0b0ee1d1f0c469426c23e93fe03ef32ed873b0415fdb1ec43a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
458KB

MD5
bfa40de5db5a15e0317dd72d982083dc

SHA1
fb93616799e85771a028944148bad57b15d0289b

SHA256
0feeb8481e07c0d5c1973f7a1644b788d56c9616c82ae0ce73505893664804a1

SHA512
cb39b9299485795ea810cb8f36b65bb3b816c37b7edd580bacccfaa8f9c222e0ebe08418ebef28512a2e87fc0ed758d5c6b3c445dfa5900e64d911fded2043c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
458KB

MD5
bfa40de5db5a15e0317dd72d982083dc

SHA1
fb93616799e85771a028944148bad57b15d0289b

SHA256
0feeb8481e07c0d5c1973f7a1644b788d56c9616c82ae0ce73505893664804a1

SHA512
cb39b9299485795ea810cb8f36b65bb3b816c37b7edd580bacccfaa8f9c222e0ebe08418ebef28512a2e87fc0ed758d5c6b3c445dfa5900e64d911fded2043c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
458KB

MD5
bfa40de5db5a15e0317dd72d982083dc

SHA1
fb93616799e85771a028944148bad57b15d0289b

SHA256
0feeb8481e07c0d5c1973f7a1644b788d56c9616c82ae0ce73505893664804a1

SHA512
cb39b9299485795ea810cb8f36b65bb3b816c37b7edd580bacccfaa8f9c222e0ebe08418ebef28512a2e87fc0ed758d5c6b3c445dfa5900e64d911fded2043c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
208KB

MD5
c468cf82c898bb34050f63b87d55d11f

SHA1
ced1e3790fba35c3ac117cd72ef16fac08a19f61

SHA256
b2ecdd617f95e11465fe0f4a3b20faeeb70ac413bc22dc395eff131d3b19f4ca

SHA512
f033e43a09ee245b0e5fc2d5e5bd562b31b41ecb8e620b4a270010c45ee1e6d4302af2f4186d775e995b689e5c2c2308c0ce179cd98f2c78c31298a576a3d9a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
208KB

MD5
c468cf82c898bb34050f63b87d55d11f

SHA1
ced1e3790fba35c3ac117cd72ef16fac08a19f61

SHA256
b2ecdd617f95e11465fe0f4a3b20faeeb70ac413bc22dc395eff131d3b19f4ca

SHA512
f033e43a09ee245b0e5fc2d5e5bd562b31b41ecb8e620b4a270010c45ee1e6d4302af2f4186d775e995b689e5c2c2308c0ce179cd98f2c78c31298a576a3d9a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
339KB

MD5
301e8d9a2445dd999ce816c17d8dbbb3

SHA1
b91163babeb738bd4d0f577ac764cee17fffe564

SHA256
2ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb

SHA512
4941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
339KB

MD5
301e8d9a2445dd999ce816c17d8dbbb3

SHA1
b91163babeb738bd4d0f577ac764cee17fffe564

SHA256
2ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb

SHA512
4941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
339KB

MD5
301e8d9a2445dd999ce816c17d8dbbb3

SHA1
b91163babeb738bd4d0f577ac764cee17fffe564

SHA256
2ea1fa52a6896ce0100084e3696712d76b4d1e995ca0012954bae3107562a9eb

SHA512
4941a820d26206fa3e333419622c3b07c8ebdaad51d1c6976df912e9ec123ad39a0c67fb5c3e362658f8463b366892fc4575d4cc2ebe62c2011d10ed5eb6bba3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip

Filesize
140KB

MD5
bbf128484e7ea29053c6db91849067ea

SHA1
c46ec37265740c349fb265099e47ebbef9369ba1

SHA256
5e6f03b5ae15131c2ad374c563273389b3340168ff647433a6b5e7acce468b05

SHA512
aeb756d2b2238eaa16a82673b6a86b609320abd6eafc4b742d0f5a9fe88fbbf34a1fd7e6ad9d2f30a832e288a3d7b725a73f83616df1d3edee92c8fd06984e7e

Download Submit
memory/448-152-0x00007FFD36770000-0x00007FFD371A6000-memory.dmp

Filesize
10.2MB

Download
memory/1348-139-0x00007FFD36770000-0x00007FFD371A6000-memory.dmp

Filesize
10.2MB

Download
memory/2732-161-0x000001C8CEAB0000-0x000001C8CEAD2000-memory.dmp

Filesize
136KB

Download
memory/4108-132-0x00007FFD36770000-0x00007FFD371A6000-memory.dmp

Filesize
10.2MB

Download
memory/4268-157-0x00007FFD36770000-0x00007FFD371A6000-memory.dmp

Filesize
10.2MB

Download
memory/4488-148-0x00007FFD36770000-0x00007FFD371A6000-memory.dmp

Filesize
10.2MB

Download
memory/4764-136-0x00007FFD36770000-0x00007FFD371A6000-memory.dmp

Filesize
10.2MB

Download
memory/4892-142-0x0000000000400000-0x0000000000743000-memory.dmp

Filesize
3.3MB

Download