3f2378d8df1f805e8c4ac9e7ef993e6cd021420f8f401435efc33f3d47c8cfc5

Analysis

max time kernel
146s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835594342abfcf22aaaf511606720f7b.exe
Size

4.8MB
MD5

835594342abfcf22aaaf511606720f7b
SHA1

179da94dbb9ac3294431992cb610476a0a33b61c
SHA256

3f2378d8df1f805e8c4ac9e7ef993e6cd021420f8f401435efc33f3d47c8cfc5
SHA512

77179e0e2faca3237221aca162a29e356a5bae44339beba4acd59c5bb1d1b89b4eb1aecdbda7825a78fcfe285e018ca8d2da24926889d92cf233e95c919a8ad2
SSDEEP

12288:5MMpXKb0hNGh1kG0HWnAL7MMpXKb0hNGh1kG0HWnAL3cQnah:5MMpXS0hN0V0H7MMpXS0hN0V0HsQ8

Score

10^/10

aspackv2 persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	835594342abfcf22aaaf511606720f7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000012266-2.dat	aspack_v212_v242
behavioral1/files/0x0008000000012266-4.dat	aspack_v212_v242
behavioral1/files/0x0008000000012266-7.dat	aspack_v212_v242
behavioral1/files/0x0008000000012266-8.dat	aspack_v212_v242
behavioral1/files/0x0008000000012266-9.dat	aspack_v212_v242
behavioral1/files/0x0001000000000026-20.dat	aspack_v212_v242
behavioral1/files/0x002d0000000155e9-38.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	835594342abfcf22aaaf511606720f7b.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
1976	835594342abfcf22aaaf511606720f7b.exe
1976	835594342abfcf22aaaf511606720f7b.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\U:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\N:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\Z:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\T:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\E:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\H:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\I:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\Q:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\A:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\Y:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\O:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\V:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\W:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\X:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\G:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\M:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\K:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\J:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\P:	835594342abfcf22aaaf511606720f7b.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\B:	835594342abfcf22aaaf511606720f7b.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	C:\AUTORUN.INF	835594342abfcf22aaaf511606720f7b.exe
File opened for modification	F:\AUTORUN.INF	835594342abfcf22aaaf511606720f7b.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	835594342abfcf22aaaf511606720f7b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2648	1976	835594342abfcf22aaaf511606720f7b.exe	28
PID 1976 wrote to memory of 2648	1976	835594342abfcf22aaaf511606720f7b.exe	28
PID 1976 wrote to memory of 2648	1976	835594342abfcf22aaaf511606720f7b.exe	28
PID 1976 wrote to memory of 2648	1976	835594342abfcf22aaaf511606720f7b.exe	28

C:\Users\Admin\AppData\Local\Temp\835594342abfcf22aaaf511606720f7b.exe
"C:\Users\Admin\AppData\Local\Temp\835594342abfcf22aaaf511606720f7b.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-928733405-3780110381-2966456290-1000\desktop.ini.exe

Filesize
206KB

MD5
031dd2e0b3f1bb99fc9785f57454f918

SHA1
fa9d9fc878a4cc26b9ec661bbee3f14e4a0a6369

SHA256
5f5fc20de4e1dee2c26d940a1a872fb75a3eb7a38037811db22e77b49bfee3b0

SHA512
b7b3cce7d3dfe61fb5f1bc8c7129e0c8ab6ce2fa5d3220547d419f0853f4059f06ef1d8abb5ad5d48015e548fffc901d0f2832af6ead19c96814e2e9c9870e16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
f73259b49051fb37c2b4b574196a0aa5

SHA1
e55eae4ce24adbf9f56272f2e50ba5e38f6ca9cc

SHA256
a3ce90cef0854d824a1034329eddec141dee10b15a788ba686ac853a714a29c8

SHA512
033d5d84e20006b4616eda1319598efa4318750861b78892a9e2db735e9719dbbdc81feb4a7a3c80299f68028b49e98314a3ab79280b4bf8bd852b20a254ad2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
33879383e86fc035bd6a1471c2d3ac38

SHA1
64954d367cf9adee346845fd07cecc4764a535c3

SHA256
816e9c18d08f4bac0464fd9a6e71cc871a2252579f53ea9e39779b9f4ed023fa

SHA512
f77556971a2a53495b289168bab6642403c09bdc046bd97e150fcdcd230a68fc7769111214fde0d0fe98e1850b7381cd7412a6b60db7a716d8da7cc0da1e3443

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
553KB

MD5
a72c30df48844814314dd96293683cfd

SHA1
321e18a680b8b6b98945bad9bc8bda773d96dea2

SHA256
f63bc028d0637aa3c8510b7ff9c87a2b4bd15261d25bcbe700587429c71531d0

SHA512
81f37cf6755199763ae190920bb8ddd6ef062752901e174df4eb6f7bbe93c5558d25d095ffc3dc10db25d13e9784af26f219fd23a249468311e78f4ace629867

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
544KB

MD5
68ad92215ed784efbcd6ecccfafb7491

SHA1
d917d747e009f6d805e72fdd4a5c6801a1087cd8

SHA256
8a90476381b87adffa52a2ac6cf2c57cfa870d97d57fdae25a9a3d869e4a63a6

SHA512
726533d7e0534fd82196ed6826e9d5df127d880100e86258557aa9bf69d478fb758d734de1a8f07afe230f5fc35d4d1d02f2c8fcf4b7196fff729b98c756faa6

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
746KB

MD5
795101887193506fe7a0e4bc2ac63f87

SHA1
8d28d536d321ab31367780614c066385dc95b8f4

SHA256
59c981c37556cbe6c360e12651570b0315a659c480060b80aff53a5dd85dbb83

SHA512
c144c92c4aebb1f406cebe90dff5b6693c3b0525ee58e87202ea87cfd1c6cbb1a47d609fe8d566239a632d90672f46fce7c65fca8baa9380d914cbf00663f237

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
35KB

MD5
ba32fd03fc0eb326ef038ed39bdd50bf

SHA1
de58b74d392ab6b15a15a04e96e8ed6fee1f25de

SHA256
32481f69dd81ace121acfceeb916bc49db1a0793d8a6498f8393ce87e490a4cb

SHA512
b855484ebcdc0d2000c2c53599256994a9eafca6c1ad3bd84a91b1a4aafc0dd9e15b55bcdf7d98a1a3c05b3c7e73f01aad20879ad8502045e39a45d6f2942f83

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
214KB

MD5
4634300ee779a2248237ab13cf83048b

SHA1
1979bbafb174269ac913a48f5520d172a5d92a5f

SHA256
f728515be0068dea2d8a6b809d09da756fc4254fb751764691db1b812c10c347

SHA512
f3c27e70ee069362270d6ebffc6c4b41a3c7713e14a910008341347418d5d59eabc9ab0a516391504c0fc0dd99cde1a0f5218bd5e060b6b37c904e6ea9190565

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
866KB

MD5
0ad7a7e098b884ac4e4b90ef17e66e49

SHA1
d9ea636d9a3f3a913ba1e50247d3a71a02269978

SHA256
5f7757461d25fc54c7a84a73ec48a9166f0d9ea88dbc67bd3fe5c6502200ae69

SHA512
0f5fd315f1501e3d196065a487a884b175a3c475096e72fa634a7576c5b2d3811a15317379444155343398fafba287453fc365f17c4369b28f0267ea54aff618

Download Submit
memory/1976-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1976-100-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2648-10-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads