3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af

General

Target

3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
Size

22.4MB
MD5

61fd84702d4f94cc3f109b1f9775d27b
SHA1

6f4dab619a746f15d65f0092f0f8bf948fcc66dd
SHA256

3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af
SHA512

2d67d9282fff90bd0d6824436a2a1cb73312dd22e6059bc5c6664968cfcd325bc11530a66c161f633f39a8ecc4d5a982e337c911798b9a87bd45461960d18fec
SSDEEP

393216:BgfZYnBE6RjOlxT5oKYKzYR8GFo/kok1Bb2/6JbuCFF2/VZz8LlfhszMzhZlOwWJ:KZCG6NUxTjYwYR7o/PkXZJbi/HWlfhEp

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\badatapr.dll	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

BurnAware.exe

pid process

1636 BurnAware.exe
Loads dropped DLL 1 IoCs

Processes:

3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe

pid process

684 3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BurnAware.exe

pid process

1636 BurnAware.exe

pid	process
1636	BurnAware.exe

pid	process
684	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe

pid	process
1636	BurnAware.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe

description	pid	process	target process
PID 2016 wrote to memory of 684	2016	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
PID 2016 wrote to memory of 684	2016	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
PID 2016 wrote to memory of 684	2016	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
PID 2016 wrote to memory of 684	2016	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
PID 684 wrote to memory of 1636	684	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	BurnAware.exe
PID 684 wrote to memory of 1636	684	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	BurnAware.exe
PID 684 wrote to memory of 1636	684	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	BurnAware.exe
PID 684 wrote to memory of 1636	684	3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe	BurnAware.exe

C:\Users\Admin\AppData\Local\Temp\3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
"C:\Users\Admin\AppData\Local\Temp\3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe
"C:\Users\Admin\AppData\Local\Temp\3fe991c2d146252b0f3bcb904fee4cfe47a4f2153229bd4ac0a99922196493af.exe" -sfxwaitall:0 "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\BurnAware.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\BurnAware.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\BurnAware.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\BurnAware.exe
Filesize
2.7MB

MD5
50cf896753ff6a274c4f7c15f8c5cc15

SHA1
a85ddef5a14cf219efb4d0753b5a94a3a574c7d3

SHA256
15b5678d92189473f93598365ab614e23c318a1645946bc268e30036c4e1e472

SHA512
401edbdbc319919d7c2e593befab956510aa75ed419f71bb4bd9b16ad67777c097b6f1adbdf61d60bf98bfa9d8f2dc48dfdc59e2569cb90b2f181ca5d38d0e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\BurnAware.exe
Filesize
2.7MB

MD5
50cf896753ff6a274c4f7c15f8c5cc15

SHA1
a85ddef5a14cf219efb4d0753b5a94a3a574c7d3

SHA256
15b5678d92189473f93598365ab614e23c318a1645946bc268e30036c4e1e472

SHA512
401edbdbc319919d7c2e593befab956510aa75ed419f71bb4bd9b16ad67777c097b6f1adbdf61d60bf98bfa9d8f2dc48dfdc59e2569cb90b2f181ca5d38d0e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\badatapr.dll
Filesize
541KB

MD5
ec5fe604ed81b782d554ae61ccb64ba8

SHA1
38f82b4e4aa1951a221eee7d7649305c1950f6c3

SHA256
3802f1d097c00397475c0d48f2646caf66eeebd92a8be59cb0774356cbdb8642

SHA512
2055e095174b63c4dafb307fba4ddbc624270a69ecb19980df3d022d7b6196fc982a8750fcad33852198c25a640c38fe8b79f206dd653821c072234bc008faf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\chinese_simp.lng
Filesize
25KB

MD5
938e51a4fac3272e0a780f015ca29c36

SHA1
84aff3543453cc9d376901f97aac80484a1cd37a

SHA256
feecdc4160c51753a8ec8f493d64c54c442051dd1adc9921a0ea63eac70c9575

SHA512
6bd566c1a26c144ff020ea0e8bc5dcf70a784da2113108be3ec30a26ce1a82f8328cb990becb1a063893bfd842030ee024f04f312a378d376dccb4f7446d8862

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BurnAware\BurnAware.exe
Filesize
2.7MB

MD5
50cf896753ff6a274c4f7c15f8c5cc15

SHA1
a85ddef5a14cf219efb4d0753b5a94a3a574c7d3

SHA256
15b5678d92189473f93598365ab614e23c318a1645946bc268e30036c4e1e472

SHA512
401edbdbc319919d7c2e593befab956510aa75ed419f71bb4bd9b16ad67777c097b6f1adbdf61d60bf98bfa9d8f2dc48dfdc59e2569cb90b2f181ca5d38d0e5d

Download Submit
memory/1636-167-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1636-168-0x0000000000400000-0x00000000006DF000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing