c610fcca740dd30ee73688ae0229f754d5a2fd2c41d0474d7b5f619890b21da7

Analysis

max time kernel
145s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17d16711c8e1b9f7d1b086ea6b7d02cf.exe
Size

1020KB
MD5

17d16711c8e1b9f7d1b086ea6b7d02cf
SHA1

d2b1b96ee4da8996e267645bf4b28632e5e7d702
SHA256

c610fcca740dd30ee73688ae0229f754d5a2fd2c41d0474d7b5f619890b21da7
SHA512

99cea49b181b3715ab1df5fdcd01371e05c0382540d619df3903f5d2ab187b2543c91b5992a6bc93c2fd2cdf6d3e130ab775b1ff166f9861d8b47ed412aa618c
SSDEEP

24576:d563ey8gZqj4yRhgrvPxDu+NlcDAbOBGJs0lp0f+yUiQoTj:P/+qEyXgrvPpu+LcEywJblp0fDo2j

Score

10^/10

aspackv2 persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	lncom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lncom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	lncom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	lncom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	lncom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	lncom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a0000000165c9-52.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
1376	lncom_.exe
1896	lncom.exe
2728	fservice.exe
2832	services.exe

Loads dropped DLL 17 IoCs

pid	Process
1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe
1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe
1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe
1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe
1896	lncom.exe
1896	lncom.exe
2832	services.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2832	services.exe
2728	fservice.exe
1896	lncom.exe
2608	WerFault.exe
2608	WerFault.exe
240	WerFault.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000001225c-3.dat	upx
behavioral1/memory/1880-4-0x0000000007280000-0x00000000073B8000-memory.dmp	upx
behavioral1/memory/1376-12-0x0000000000400000-0x0000000000538000-memory.dmp	upx
behavioral1/files/0x000a000000012233-21.dat	upx
behavioral1/memory/1896-24-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/2728-39-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/2832-50-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/1376-60-0x0000000000400000-0x0000000000538000-memory.dmp	upx
behavioral1/memory/2728-69-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/1896-70-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral1/memory/2832-77-0x0000000000400000-0x00000000005FC000-memory.dmp	upx

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	lncom.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lncom.exe	17d16711c8e1b9f7d1b086ea6b7d02cf.exe
File created	C:\Windows\SysWOW64\lncom_.exe	17d16711c8e1b9f7d1b086ea6b7d02cf.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	lncom.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	lncom.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\sservice.exe	lncom.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File opened for modification	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	lncom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2608	1376	WerFault.exe	28
240	2832	WerFault.exe	32

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	services.exe
2832	services.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1376	lncom_.exe
1376	lncom_.exe
1376	lncom_.exe
1376	lncom_.exe
2832	services.exe
2832	services.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1376	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	28
PID 1880 wrote to memory of 1376	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	28
PID 1880 wrote to memory of 1376	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	28
PID 1880 wrote to memory of 1376	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	28
PID 1880 wrote to memory of 1896	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	29
PID 1880 wrote to memory of 1896	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	29
PID 1880 wrote to memory of 1896	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	29
PID 1880 wrote to memory of 1896	1880	17d16711c8e1b9f7d1b086ea6b7d02cf.exe	29
PID 1896 wrote to memory of 2728	1896	lncom.exe	30
PID 1896 wrote to memory of 2728	1896	lncom.exe	30
PID 1896 wrote to memory of 2728	1896	lncom.exe	30
PID 1896 wrote to memory of 2728	1896	lncom.exe	30
PID 1376 wrote to memory of 2608	1376	lncom_.exe	31
PID 1376 wrote to memory of 2608	1376	lncom_.exe	31
PID 1376 wrote to memory of 2608	1376	lncom_.exe	31
PID 1376 wrote to memory of 2608	1376	lncom_.exe	31
PID 2728 wrote to memory of 2832	2728	fservice.exe	32
PID 2728 wrote to memory of 2832	2728	fservice.exe	32
PID 2728 wrote to memory of 2832	2728	fservice.exe	32
PID 2728 wrote to memory of 2832	2728	fservice.exe	32
PID 2832 wrote to memory of 2576	2832	services.exe	33
PID 2832 wrote to memory of 2576	2832	services.exe	33
PID 2832 wrote to memory of 2576	2832	services.exe	33
PID 2832 wrote to memory of 2576	2832	services.exe	33
PID 2832 wrote to memory of 2584	2832	services.exe	35
PID 2832 wrote to memory of 2584	2832	services.exe	35
PID 2832 wrote to memory of 2584	2832	services.exe	35
PID 2832 wrote to memory of 2584	2832	services.exe	35
PID 2576 wrote to memory of 2124	2576	NET.exe	37
PID 2576 wrote to memory of 2124	2576	NET.exe	37
PID 2576 wrote to memory of 2124	2576	NET.exe	37
PID 2576 wrote to memory of 2124	2576	NET.exe	37
PID 2584 wrote to memory of 112	2584	NET.exe	38
PID 2584 wrote to memory of 112	2584	NET.exe	38
PID 2584 wrote to memory of 112	2584	NET.exe	38
PID 2584 wrote to memory of 112	2584	NET.exe	38
PID 2832 wrote to memory of 240	2832	services.exe	39
PID 2832 wrote to memory of 240	2832	services.exe	39
PID 2832 wrote to memory of 240	2832	services.exe	39
PID 2832 wrote to memory of 240	2832	services.exe	39

C:\Users\Admin\AppData\Local\Temp\17d16711c8e1b9f7d1b086ea6b7d02cf.exe
"C:\Users\Admin\AppData\Local\Temp\17d16711c8e1b9f7d1b086ea6b7d02cf.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\lncom_.exe
  "C:\Windows\system32\lncom_.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 400
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2608
- C:\Windows\SysWOW64\lncom.exe
  "C:\Windows\system32\lncom.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\fservice.exe
    C:\Windows\system32\fservice.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\services.exe
      C:\Windows\services.exe -XP
      4⤵
      Modifies WinLogon for persistence
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP srservice
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2576
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        6⤵
        
        PID:2124
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP navapsvc
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        6⤵
        
        PID:112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 576
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\lncom.exe

Filesize
342KB

MD5
f7a9aa79f0cbfc42058ab36379f52d66

SHA1
bbf3da030d7edc30f3a9c7cfd159643593ac7d2f

SHA256
3f7f78e760e239c9ee2622b3a1acc8b99ac2eee6382e73946823363814be55b8

SHA512
bb8d639d48244b372b7702927d3d525f2136a26cedf3271bf633d7a5124f875b01913c0794da8e65b00c7a9c2026f39ee51a84d8ec01bcdb7f46c592cc9c4415

Download Submit
\Windows\SysWOW64\lncom_.exe

Filesize
673KB

MD5
85d65bdfa28d3e54e1a22bc70aeb0841

SHA1
6844695050fc76b9de2154cb54209107d4581966

SHA256
ce1813d60258de8c9138b043a286bc2730db68e5ac0a7d7750e681ca7ab66a3c

SHA512
c50a31a55cd0338be0dce7df9a456fc8f8286857dfd0d2c75a29bccadd86f57996befeaba5dca08ce2fd52eca194718342d6fd37d5009fd8aad8aabed9e5246b

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
562e0d01d6571fa2251a1e9f54c6cc69

SHA1
83677ad3bc630aa6327253c7b3deffbd4a8ce905

SHA256
c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6

SHA512
166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

Download Submit
\Windows\SysWOW64\winkey.dll

Filesize
13KB

MD5
b4c72da9fd1a0dcb0698b7da97daa0cd

SHA1
b25a79e8ea4c723c58caab83aed6ea48de7ed759

SHA256
45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

SHA512
f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

Download Submit
memory/1376-12-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1376-60-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1880-4-0x0000000007280000-0x00000000073B8000-memory.dmp

Filesize
1.2MB

Download
memory/1880-22-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1880-23-0x0000000007290000-0x000000000748C000-memory.dmp

Filesize
2.0MB

Download
memory/1880-75-0x0000000007290000-0x000000000748C000-memory.dmp

Filesize
2.0MB

Download
memory/1896-24-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/1896-70-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/1896-26-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2728-54-0x0000000003100000-0x00000000032FC000-memory.dmp

Filesize
2.0MB

Download
memory/2728-40-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2728-39-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2728-69-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2832-55-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2832-50-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2832-61-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2832-77-0x0000000000400000-0x00000000005FC000-memory.dmp

Filesize
2.0MB

Download
memory/2832-82-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download