e52400988a07ce80c2b963cff043e868dcd58b804304e878c882dd398c94a418

General

Target

NEAS.afc0e8ca805126afea6a435f63a87820.exe
Size

210KB
MD5

afc0e8ca805126afea6a435f63a87820
SHA1

e85b1556917ae98d63ad0d2271caa33c1489c03a
SHA256

e52400988a07ce80c2b963cff043e868dcd58b804304e878c882dd398c94a418
SHA512

4d4dad888ff21a27c77738d96781b53b220642a6f1dbf54edb5ed6a5855e7a8205c21779a1dcfc9d3d97714bff5b3fa71d236a5f114e6c2d8600ae9e535c8e49
SSDEEP

3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c2:dOizzb8uDxZCHlIZgEh5DyXglh

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000e00000001225d-14.dat	aspack_v212_v242
behavioral1/files/0x000e00000001225d-18.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2668	CRIWIQU.EXE

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	CRIWIQU.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\$Recycle.Bin\\CGU.EXE \"%1\" %*"	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VVZ.EXE = "C:\\System Volume Information\\OJWMH.EXE"	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\J:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\L:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\Q:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\T:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\U:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\E:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\K:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\O:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\P:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\R:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\S:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\V:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\H:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\I:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\M:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\N:	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CRIWIQU.EXE	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\System Volume Information\\VURDFD.EXE %1"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\System Volume Information\\DEMUDZ.EXE %1"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\System Volume Information\\VURDFD.EXE \"%1\""	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	CRIWIQU.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\$Recycle.Bin\\CGU.EXE \"%1\" %*"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\System Volume Information\\VURDFD.EXE \"%1\""	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	CRIWIQU.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2668	3068	NEAS.afc0e8ca805126afea6a435f63a87820.exe	28
PID 3068 wrote to memory of 2668	3068	NEAS.afc0e8ca805126afea6a435f63a87820.exe	28
PID 3068 wrote to memory of 2668	3068	NEAS.afc0e8ca805126afea6a435f63a87820.exe	28
PID 3068 wrote to memory of 2668	3068	NEAS.afc0e8ca805126afea6a435f63a87820.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.afc0e8ca805126afea6a435f63a87820.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.afc0e8ca805126afea6a435f63a87820.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\CRIWIQU.EXE
  C:\Windows\CRIWIQU.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\CRIWIQU.EXE

Filesize
211KB

MD5
9eb10f4fe50726bd93a9afc2eafab948

SHA1
78b9f56fe2798b1834d628061319b25d1debdd99

SHA256
1dbf42bfdff22ed8b465e6987ede02cbc0f5b0e74a15cf62faa320e68f51f8a9

SHA512
a66e03a1b2d0166a8c8904e4ac2cc125b51d8db75e9b0c4f50b1346d1419f2f4c0bc15eb41948dab749117eedd39faa6ce8f0a705c8a1be341cf4676a376cbd6

Download Submit
C:\Windows\CRIWIQU.EXE

Filesize
211KB

MD5
9eb10f4fe50726bd93a9afc2eafab948

SHA1
78b9f56fe2798b1834d628061319b25d1debdd99

SHA256
1dbf42bfdff22ed8b465e6987ede02cbc0f5b0e74a15cf62faa320e68f51f8a9

SHA512
a66e03a1b2d0166a8c8904e4ac2cc125b51d8db75e9b0c4f50b1346d1419f2f4c0bc15eb41948dab749117eedd39faa6ce8f0a705c8a1be341cf4676a376cbd6

Download Submit
memory/2668-28-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-27-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-35-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-21-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-22-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-23-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2668-24-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-25-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-26-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-19-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2668-34-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-29-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-30-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-31-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2668-33-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3068-0-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/3068-20-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads