3ae2b09977ad7944fd6ff36b7a3240ff9c8f8438fe1ff71db6390233663b885e

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe
Size

802KB
MD5

43dc1d7eeef9b4ca0d455404b12c34c8
SHA1

2e618174d09b00abc16d34bff7b646e036adf253
SHA256

a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf
SHA512

b65a6542520ae094d8f9101d062339a997aa2eaed426e3aaa4c79145d97debf75062df334df4c02d874ebe15731e035bbf7b7cd0f55c248d4b6a45294c5c70c7
SSDEEP

24576:Sny/f9uCOXP25JiBvuXwKhbBh4iv/IVVWX77Sj+ithPW1:XF0IJSmgaVhvv/IVKyj+d

Score

8^/10

aspackv2

Malware Config

Signatures

Downloads MZ/PE file

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe	aspack_v212_v242

Executes dropped EXE 3 IoCs

Processes:

Project.exe_config.exe_config.exe

pid process

1440 Project.exe
1460 _config.exe
1232 _config.exe

pid	process
1440	Project.exe
1460	_config.exe
1232	_config.exe

Loads dropped DLL 7 IoCs

Processes:

a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exeProject.exe

pid	process
904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe
904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe
904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe
904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe
1440	Project.exe
1440	Project.exe
1440	Project.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

helppane.exe

description pid process

Token: SeTakeOwnershipPrivilege 1868 helppane.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

helppane.exe

pid process

1868 helppane.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

helppane.exe

pid process

1868 helppane.exe
1868 helppane.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1868	helppane.exe

pid	process
1868	helppane.exe

pid	process
1868	helppane.exe
1868	helppane.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exeProject.exehelppane.exe_config.exe

description	pid	process	target process
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 904 wrote to memory of 1440	904	a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe	Project.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1440 wrote to memory of 1460	1440	Project.exe	_config.exe
PID 1868 wrote to memory of 1232	1868	helppane.exe	_config.exe
PID 1868 wrote to memory of 1232	1868	helppane.exe	_config.exe
PID 1868 wrote to memory of 1232	1868	helppane.exe	_config.exe
PID 1868 wrote to memory of 1232	1868	helppane.exe	_config.exe
PID 1232 wrote to memory of 1516	1232	_config.exe	reg.exe
PID 1232 wrote to memory of 1516	1232	_config.exe	reg.exe
PID 1232 wrote to memory of 1516	1232	_config.exe	reg.exe
PID 1232 wrote to memory of 1516	1232	_config.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe
"C:\Users\Admin\AppData\Local\Temp\a1ee855e975db8957456fc60c33eb040b7bdc2ff79dbd9799f379a4dcade71bf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\_config.exe
"C:\Users\Admin\AppData\Local\Temp\_config.exe"
3⤵
- Executes dropped EXE
PID:1460

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\_config.exe
"C:\Users\Admin\AppData\Local\Temp\_config.exe" shell32.dll,ShellExec_RunDLL reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Startup" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\OQQSSSSSUU" /f
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v "Startup" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\OQQSSSSSUU" /f
3⤵
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Filesize
1.1MB

MD5
4d4f8aea7be8e5f2372f6dbca75aa8ba

SHA1
5ca38dbc0188d1a93a043562f67cf4319ffdd24d

SHA256
75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2

SHA512
78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Filesize
1.1MB

MD5
4d4f8aea7be8e5f2372f6dbca75aa8ba

SHA1
5ca38dbc0188d1a93a043562f67cf4319ffdd24d

SHA256
75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2

SHA512
78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\vmprotectsdk32.dll
Filesize
98KB

MD5
29e0b67635a30d87d929bc1614eff68f

SHA1
180a56d7fb6473ae8449fea7f2e6f105e9e5bb0b

SHA256
b2dd017dd8bf60e5a439a202af9e4dbd8a4bf57d72e6dc7528484c6f34eadc8e

SHA512
68a8266a1a6f2b270e9dff6b553fff4f7557ed05496aa8007b29a3bacfcf9d4228175a34460ceb43a797e8e7f44d7b33088c67fd835e3e56c64e92868ef27c49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_config.lnk
Filesize
2KB

MD5
ea385e9e82946221187a85f588dae8cb

SHA1
edb4208556cb7953910d0dee0e6a7223c1a1f940

SHA256
ec9b03b8bef70e5d0538248ac0229369cb3d5a6c51bccbb9d6bd85111df6f0bc

SHA512
514b6c74e833d28a30074a49188bdc18477b1b88b472938bafb5e6ef7be18230eb252b6dde6d0f03321af996b46d8f358187e74386b0b8d32c932ac7663bcfca

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Filesize
1.1MB

MD5
4d4f8aea7be8e5f2372f6dbca75aa8ba

SHA1
5ca38dbc0188d1a93a043562f67cf4319ffdd24d

SHA256
75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2

SHA512
78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Filesize
1.1MB

MD5
4d4f8aea7be8e5f2372f6dbca75aa8ba

SHA1
5ca38dbc0188d1a93a043562f67cf4319ffdd24d

SHA256
75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2

SHA512
78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Filesize
1.1MB

MD5
4d4f8aea7be8e5f2372f6dbca75aa8ba

SHA1
5ca38dbc0188d1a93a043562f67cf4319ffdd24d

SHA256
75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2

SHA512
78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Project.exe
Filesize
1.1MB

MD5
4d4f8aea7be8e5f2372f6dbca75aa8ba

SHA1
5ca38dbc0188d1a93a043562f67cf4319ffdd24d

SHA256
75451351d739d060273d8f6985b42596e37fc7acc27130e44dee16c589c012e2

SHA512
78f35eeeac14b8a4aabff7909f8770f13397e7f892cc46f48575818ede272c2d2d40a9bd20466144cd0d9044713002205be72212187e231a966a109b8f761097

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\VMProtectSDK32.dll
Filesize
98KB

MD5
29e0b67635a30d87d929bc1614eff68f

SHA1
180a56d7fb6473ae8449fea7f2e6f105e9e5bb0b

SHA256
b2dd017dd8bf60e5a439a202af9e4dbd8a4bf57d72e6dc7528484c6f34eadc8e

SHA512
68a8266a1a6f2b270e9dff6b553fff4f7557ed05496aa8007b29a3bacfcf9d4228175a34460ceb43a797e8e7f44d7b33088c67fd835e3e56c64e92868ef27c49

Download Submit
\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
\Users\Admin\AppData\Local\Temp\_config.exe
Filesize
82KB

MD5
cbbdef6c4d82eb4ff01ed43f1e641907

SHA1
722ba8786507f2cad599b11cdc4a139909f4f9f1

SHA256
37a5d7960b09d3f0ec4c8d39203ce285a9ced3c70c3e3fbd5c6f3f21678bdec4

SHA512
6f8cbe5555d7354920bb03177b69947cec6825bb71a4a77e154b185061214f57f7fcc75f5e477fc432a66094ff1ba4edc823abaf2cf7cd03191b4b566a85d1fd

Download Submit
memory/904-77-0x0000000003290000-0x00000000035A9000-memory.dmp

Filesize
3.1MB

Download
memory/904-79-0x0000000003290000-0x00000000035A9000-memory.dmp

Filesize
3.1MB

Download
memory/904-78-0x0000000003290000-0x00000000035A9000-memory.dmp

Filesize
3.1MB

Download
memory/1440-84-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/1440-80-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/1440-81-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1440-76-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/1440-75-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/1440-74-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/1440-73-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/1440-98-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download