1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Size

1.9MB
MD5

430c2b63372064c3e6d909635a12cfe9
SHA1

992b607f528c0f9e59ace4fc83d6b0b999816c10
SHA256

fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6
SHA512

9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b
SSDEEP

12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyiwPZ:RJcu8pl9d+VdCUhN1SsNK+1pSy1PZ

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral32/files/0x001b000000016059-24.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2380	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1212	fservice.exe
2968	services.exe

Loads dropped DLL 6 IoCs

pid	Process
1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
2968	services.exe
2968	services.exe
1212	fservice.exe
1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
File opened for modification	C:\Windows\system\sservice.exe	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe
2968	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	services.exe
2968	services.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1212	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	28
PID 1880 wrote to memory of 1212	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	28
PID 1880 wrote to memory of 1212	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	28
PID 1880 wrote to memory of 1212	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	28
PID 1212 wrote to memory of 2968	1212	fservice.exe	29
PID 1212 wrote to memory of 2968	1212	fservice.exe	29
PID 1212 wrote to memory of 2968	1212	fservice.exe	29
PID 1212 wrote to memory of 2968	1212	fservice.exe	29
PID 2968 wrote to memory of 3028	2968	services.exe	30
PID 2968 wrote to memory of 3028	2968	services.exe	30
PID 2968 wrote to memory of 3028	2968	services.exe	30
PID 2968 wrote to memory of 3028	2968	services.exe	30
PID 2968 wrote to memory of 3052	2968	services.exe	31
PID 2968 wrote to memory of 3052	2968	services.exe	31
PID 2968 wrote to memory of 3052	2968	services.exe	31
PID 2968 wrote to memory of 3052	2968	services.exe	31
PID 3052 wrote to memory of 2736	3052	NET.exe	35
PID 3052 wrote to memory of 2736	3052	NET.exe	35
PID 3052 wrote to memory of 2736	3052	NET.exe	35
PID 3052 wrote to memory of 2736	3052	NET.exe	35
PID 3028 wrote to memory of 2728	3028	NET.exe	34
PID 3028 wrote to memory of 2728	3028	NET.exe	34
PID 3028 wrote to memory of 2728	3028	NET.exe	34
PID 3028 wrote to memory of 2728	3028	NET.exe	34
PID 1880 wrote to memory of 2380	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	36
PID 1880 wrote to memory of 2380	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	36
PID 1880 wrote to memory of 2380	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	36
PID 1880 wrote to memory of 2380	1880	fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe	36

C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
"C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\fservice.exe
  C:\Windows\system32\fservice.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\services.exe
    C:\Windows\services.exe -XP
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP srservice
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        5⤵
        
        PID:2728
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP navapsvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        5⤵
        
        PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe.bat
  2⤵
  - Deletes itself
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe.bat

Filesize
133B

MD5
952c93295f56e73a6dd9cddf7c741481

SHA1
ff02a8139fdb21c4b3fd02c47127d55396f46b2b

SHA256
1db573e0788f16cbaa32fafc9afca99d1d7bb31417f8bd289c0ab06aa210aa91

SHA512
8acb4f590f07f8ea7ba03b2c7d7bba7c80468da43f13f3304143eac0cc7ce8dd2251f5fd558f3803d011f9f7cbf3489d032129ca50ba398d011108716fa7c3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe.bat

Filesize
133B

MD5
952c93295f56e73a6dd9cddf7c741481

SHA1
ff02a8139fdb21c4b3fd02c47127d55396f46b2b

SHA256
1db573e0788f16cbaa32fafc9afca99d1d7bb31417f8bd289c0ab06aa210aa91

SHA512
8acb4f590f07f8ea7ba03b2c7d7bba7c80468da43f13f3304143eac0cc7ce8dd2251f5fd558f3803d011f9f7cbf3489d032129ca50ba398d011108716fa7c3cd

Download Submit
C:\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
C:\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
C:\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
C:\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
1c1bbc7f47da44d1ae156e532017b511

SHA1
88b67447eaba3cf18c225c7d66f3e132796f7581

SHA256
cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

SHA512
ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

Download Submit
C:\Windows\services.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
C:\Windows\services.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
C:\Windows\system\sservice.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
430c2b63372064c3e6d909635a12cfe9

SHA1
992b607f528c0f9e59ace4fc83d6b0b999816c10

SHA256
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

SHA512
9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
1c1bbc7f47da44d1ae156e532017b511

SHA1
88b67447eaba3cf18c225c7d66f3e132796f7581

SHA256
cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

SHA512
ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
1c1bbc7f47da44d1ae156e532017b511

SHA1
88b67447eaba3cf18c225c7d66f3e132796f7581

SHA256
cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

SHA512
ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
1c1bbc7f47da44d1ae156e532017b511

SHA1
88b67447eaba3cf18c225c7d66f3e132796f7581

SHA256
cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

SHA512
ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

Download Submit
\Windows\SysWOW64\winkey.dll

Filesize
13KB

MD5
b4c72da9fd1a0dcb0698b7da97daa0cd

SHA1
b25a79e8ea4c723c58caab83aed6ea48de7ed759

SHA256
45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

SHA512
f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

Download Submit
memory/1212-37-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/1212-12-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1880-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1880-42-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2968-26-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2968-22-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2968-45-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2968-46-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2968-47-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2968-48-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download