a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf

Analysis

max time kernel
145s
max time network
158s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
工作报表.exe
Size 802KB
Sample230331-tctaqabc65
SHA256 a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf
MD5 43dc1d7eeef9b4ca0d455404b12c34c8
SHA1 2e618174d09b00abc16d34bff7b646e036adf253
SHA512 b65a6542520ae094d8f9101d062339a997aa2eaed426e3aaa4c79145d97debf75062df334df4c02d874ebe15731e035bbf7b7cd0f55c248d4b6a45294c5c70c7
SSDEEP 24576:Sny/f9uCOXP25JiBvuXwKhbBh4iv/IVVWX77Sj+ithPW1:XF0IJSmgaVhvv/IVKyj+d
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2

Malware Config

Signatures

Downloads MZ/PE file

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a00000001230f-59.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230f-62.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230f-64.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230f-69.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230f-67.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230f-71.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
860	Project.exe

Loads dropped DLL 5 IoCs

pid	Process
1572	工作报表.exe
1572	工作报表.exe
1572	工作报表.exe
1572	工作报表.exe
860	Project.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 860	1572	工作报表.exe	28
PID 1572 wrote to memory of 860	1572	工作报表.exe	28
PID 1572 wrote to memory of 860	1572	工作报表.exe	28
PID 1572 wrote to memory of 860	1572	工作报表.exe	28
PID 1572 wrote to memory of 860	1572	工作报表.exe	28
PID 1572 wrote to memory of 860	1572	工作报表.exe	28
PID 1572 wrote to memory of 860	1572	工作报表.exe	28

C:\Users\Admin\AppData\Local\Temp\工作报表.exe
"C:\Users\Admin\AppData\Local\Temp\工作报表.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Project.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Size 1.1MB
SHA256 75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2
MD5 4d4f8aea7be8e5f2372f6dbca75aa8ba
SHA1 5ca38dbc0188d1a93a043562f67cf4319ffdd24d
SHA512 78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097
SSDEEP 12288:rRP3LTyzWlGsqZReBfx0lpWr1utmhD+i4:rRP3LPz7fI81uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Project.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Size 1.1MB
SHA256 75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2
MD5 4d4f8aea7be8e5f2372f6dbca75aa8ba
SHA1 5ca38dbc0188d1a93a043562f67cf4319ffdd24d
SHA512 78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097
SSDEEP 12288:rRP3LTyzWlGsqZReBfx0lpWr1utmhD+i4:rRP3LPz7fI81uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vmprotectsdk32.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vmprotectsdk32.dll
Size 98KB
SHA256 b2dd017dd8bf60e5a439a202af9e4dbd8a4bf57d72e6dc7528484c6f34eadc8e
MD5 29e0b67635a30d87d929bc1614eff68f
SHA1 180a56d7fb6473ae8449fea7f2e6f105e9e5bb0b
SHA512 68a8266a1a6f2b270e9dff6b553fff4f7557ed05496aa8007b29a3bacfcf9d4228175a34460ceb43a797e8e7f44d7b33088c67fd835e3e56c64e92868ef27c49
SSDEEP 1536:ET33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwX0YXowGF:0hQC2mCYK3RhrZ9dPk2Q9yMJwX0YRG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Project.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Size 1.1MB
SHA256 75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2
MD5 4d4f8aea7be8e5f2372f6dbca75aa8ba
SHA1 5ca38dbc0188d1a93a043562f67cf4319ffdd24d
SHA512 78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097
SSDEEP 12288:rRP3LTyzWlGsqZReBfx0lpWr1utmhD+i4:rRP3LPz7fI81uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Project.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Size 1.1MB
SHA256 75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2
MD5 4d4f8aea7be8e5f2372f6dbca75aa8ba
SHA1 5ca38dbc0188d1a93a043562f67cf4319ffdd24d
SHA512 78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097
SSDEEP 12288:rRP3LTyzWlGsqZReBfx0lpWr1utmhD+i4:rRP3LPz7fI81uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Project.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Size 1.1MB
SHA256 75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2
MD5 4d4f8aea7be8e5f2372f6dbca75aa8ba
SHA1 5ca38dbc0188d1a93a043562f67cf4319ffdd24d
SHA512 78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097
SSDEEP 12288:rRP3LTyzWlGsqZReBfx0lpWr1utmhD+i4:rRP3LPz7fI81uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Project.exe

Path \Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Size 1.1MB
SHA256 75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2
MD5 4d4f8aea7be8e5f2372f6dbca75aa8ba
SHA1 5ca38dbc0188d1a93a043562f67cf4319ffdd24d
SHA512 78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097
SSDEEP 12288:rRP3LTyzWlGsqZReBfx0lpWr1utmhD+i4:rRP3LPz7fI81uf
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMProtectSDK32.dll

Path \Users\Admin\AppData\Local\Temp\RarSFX0\VMProtectSDK32.dll
Size 98KB
SHA256 b2dd017dd8bf60e5a439a202af9e4dbd8a4bf57d72e6dc7528484c6f34eadc8e
MD5 29e0b67635a30d87d929bc1614eff68f
SHA1 180a56d7fb6473ae8449fea7f2e6f105e9e5bb0b
SHA512 68a8266a1a6f2b270e9dff6b553fff4f7557ed05496aa8007b29a3bacfcf9d4228175a34460ceb43a797e8e7f44d7b33088c67fd835e3e56c64e92868ef27c49
SSDEEP 1536:ET33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwX0YXowGF:0hQC2mCYK3RhrZ9dPk2Q9yMJwX0YRG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-74-0x0000000000400000-0x0000000000719000-memory.dmp

Download

memory/860-75-0x0000000000400000-0x0000000000719000-memory.dmp

Download

memory/860-76-0x0000000000400000-0x0000000000719000-memory.dmp

Download

memory/860-77-0x0000000000400000-0x0000000000719000-memory.dmp

Download

memory/860-81-0x0000000000400000-0x0000000000719000-memory.dmp

Download

memory/860-82-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/860-83-0x0000000000400000-0x0000000000719000-memory.dmp

Download

memory/1572-61-0x00000000031E0000-0x00000000034F9000-memory.dmp

Download

memory/1572-78-0x00000000031E0000-0x00000000034F9000-memory.dmp

Download

memory/1572-79-0x00000000031E0000-0x00000000034F9000-memory.dmp

Download

memory/1572-80-0x00000000031E0000-0x00000000034F9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads