72944d9bceaa8c5b7fdc292536a8a84873cfa83e312d5137bcacad4154a7bd1b

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

038288d17474db91bf81b1f7a0009ffc.exe
Size

58KB
MD5

038288d17474db91bf81b1f7a0009ffc
SHA1

477bd93a617afba29f03cd023d80d980e601246d
SHA256

72944d9bceaa8c5b7fdc292536a8a84873cfa83e312d5137bcacad4154a7bd1b
SHA512

76e42a7372f646d81167af23d295eac62bdd889cbd6f94165c3fb8bc3a5023a2d5bbb2a352e71cf5bda062c3e187ef1bbee169097dc2505ed8df47390d264444
SSDEEP

768:C7HXD82PGkvpkwCpAudJ9iCM5da8q6Dh/TluAjhcnPrLh3szNJ89XOaZJgUKU4kf:4TokvpkrA9CMzvqI/TlHu3TZJRx4km

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b000000012238-17.dat	aspack_v212_v242

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system\\038288d17474db91bf81b1f7a0009ffc.exe"	regedit.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\038288d17474db91bf81b1f7a0009ffc.exe	038288d17474db91bf81b1f7a0009ffc.exe
File opened for modification	C:\Windows\system\038288d17474db91bf81b1f7a0009ffc.exe	038288d17474db91bf81b1f7a0009ffc.exe

Runs .reg file with regedit 15 IoCs

pid	Process
3024	regedit.exe
764	regedit.exe
2024	regedit.exe
2928	regedit.exe
436	regedit.exe
2876	regedit.exe
948	regedit.exe
2692	regedit.exe
2852	regedit.exe
2904	regedit.exe
2672	regedit.exe
1732	regedit.exe
1540	regedit.exe
2384	regedit.exe
1640	regedit.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1640	2000	038288d17474db91bf81b1f7a0009ffc.exe	28
PID 2000 wrote to memory of 1640	2000	038288d17474db91bf81b1f7a0009ffc.exe	28
PID 2000 wrote to memory of 1640	2000	038288d17474db91bf81b1f7a0009ffc.exe	28
PID 2000 wrote to memory of 1640	2000	038288d17474db91bf81b1f7a0009ffc.exe	28
PID 2000 wrote to memory of 2672	2000	038288d17474db91bf81b1f7a0009ffc.exe	29
PID 2000 wrote to memory of 2672	2000	038288d17474db91bf81b1f7a0009ffc.exe	29
PID 2000 wrote to memory of 2672	2000	038288d17474db91bf81b1f7a0009ffc.exe	29
PID 2000 wrote to memory of 2672	2000	038288d17474db91bf81b1f7a0009ffc.exe	29
PID 2000 wrote to memory of 2692	2000	038288d17474db91bf81b1f7a0009ffc.exe	30
PID 2000 wrote to memory of 2692	2000	038288d17474db91bf81b1f7a0009ffc.exe	30
PID 2000 wrote to memory of 2692	2000	038288d17474db91bf81b1f7a0009ffc.exe	30
PID 2000 wrote to memory of 2692	2000	038288d17474db91bf81b1f7a0009ffc.exe	30
PID 2000 wrote to memory of 2928	2000	038288d17474db91bf81b1f7a0009ffc.exe	31
PID 2000 wrote to memory of 2928	2000	038288d17474db91bf81b1f7a0009ffc.exe	31
PID 2000 wrote to memory of 2928	2000	038288d17474db91bf81b1f7a0009ffc.exe	31
PID 2000 wrote to memory of 2928	2000	038288d17474db91bf81b1f7a0009ffc.exe	31
PID 2000 wrote to memory of 3024	2000	038288d17474db91bf81b1f7a0009ffc.exe	34
PID 2000 wrote to memory of 3024	2000	038288d17474db91bf81b1f7a0009ffc.exe	34
PID 2000 wrote to memory of 3024	2000	038288d17474db91bf81b1f7a0009ffc.exe	34
PID 2000 wrote to memory of 3024	2000	038288d17474db91bf81b1f7a0009ffc.exe	34
PID 2000 wrote to memory of 1732	2000	038288d17474db91bf81b1f7a0009ffc.exe	35
PID 2000 wrote to memory of 1732	2000	038288d17474db91bf81b1f7a0009ffc.exe	35
PID 2000 wrote to memory of 1732	2000	038288d17474db91bf81b1f7a0009ffc.exe	35
PID 2000 wrote to memory of 1732	2000	038288d17474db91bf81b1f7a0009ffc.exe	35
PID 2000 wrote to memory of 436	2000	038288d17474db91bf81b1f7a0009ffc.exe	36
PID 2000 wrote to memory of 436	2000	038288d17474db91bf81b1f7a0009ffc.exe	36
PID 2000 wrote to memory of 436	2000	038288d17474db91bf81b1f7a0009ffc.exe	36
PID 2000 wrote to memory of 436	2000	038288d17474db91bf81b1f7a0009ffc.exe	36
PID 2000 wrote to memory of 764	2000	038288d17474db91bf81b1f7a0009ffc.exe	37
PID 2000 wrote to memory of 764	2000	038288d17474db91bf81b1f7a0009ffc.exe	37
PID 2000 wrote to memory of 764	2000	038288d17474db91bf81b1f7a0009ffc.exe	37
PID 2000 wrote to memory of 764	2000	038288d17474db91bf81b1f7a0009ffc.exe	37
PID 2000 wrote to memory of 2876	2000	038288d17474db91bf81b1f7a0009ffc.exe	38
PID 2000 wrote to memory of 2876	2000	038288d17474db91bf81b1f7a0009ffc.exe	38
PID 2000 wrote to memory of 2876	2000	038288d17474db91bf81b1f7a0009ffc.exe	38
PID 2000 wrote to memory of 2876	2000	038288d17474db91bf81b1f7a0009ffc.exe	38
PID 2000 wrote to memory of 2024	2000	038288d17474db91bf81b1f7a0009ffc.exe	39
PID 2000 wrote to memory of 2024	2000	038288d17474db91bf81b1f7a0009ffc.exe	39
PID 2000 wrote to memory of 2024	2000	038288d17474db91bf81b1f7a0009ffc.exe	39
PID 2000 wrote to memory of 2024	2000	038288d17474db91bf81b1f7a0009ffc.exe	39
PID 2000 wrote to memory of 948	2000	038288d17474db91bf81b1f7a0009ffc.exe	40
PID 2000 wrote to memory of 948	2000	038288d17474db91bf81b1f7a0009ffc.exe	40
PID 2000 wrote to memory of 948	2000	038288d17474db91bf81b1f7a0009ffc.exe	40
PID 2000 wrote to memory of 948	2000	038288d17474db91bf81b1f7a0009ffc.exe	40
PID 2000 wrote to memory of 1540	2000	038288d17474db91bf81b1f7a0009ffc.exe	41
PID 2000 wrote to memory of 1540	2000	038288d17474db91bf81b1f7a0009ffc.exe	41
PID 2000 wrote to memory of 1540	2000	038288d17474db91bf81b1f7a0009ffc.exe	41
PID 2000 wrote to memory of 1540	2000	038288d17474db91bf81b1f7a0009ffc.exe	41
PID 2000 wrote to memory of 2904	2000	038288d17474db91bf81b1f7a0009ffc.exe	42
PID 2000 wrote to memory of 2904	2000	038288d17474db91bf81b1f7a0009ffc.exe	42
PID 2000 wrote to memory of 2904	2000	038288d17474db91bf81b1f7a0009ffc.exe	42
PID 2000 wrote to memory of 2904	2000	038288d17474db91bf81b1f7a0009ffc.exe	42
PID 2000 wrote to memory of 2852	2000	038288d17474db91bf81b1f7a0009ffc.exe	43
PID 2000 wrote to memory of 2852	2000	038288d17474db91bf81b1f7a0009ffc.exe	43
PID 2000 wrote to memory of 2852	2000	038288d17474db91bf81b1f7a0009ffc.exe	43
PID 2000 wrote to memory of 2852	2000	038288d17474db91bf81b1f7a0009ffc.exe	43
PID 2000 wrote to memory of 2384	2000	038288d17474db91bf81b1f7a0009ffc.exe	44
PID 2000 wrote to memory of 2384	2000	038288d17474db91bf81b1f7a0009ffc.exe	44
PID 2000 wrote to memory of 2384	2000	038288d17474db91bf81b1f7a0009ffc.exe	44
PID 2000 wrote to memory of 2384	2000	038288d17474db91bf81b1f7a0009ffc.exe	44

C:\Users\Admin\AppData\Local\Temp\038288d17474db91bf81b1f7a0009ffc.exe
"C:\Users\Admin\AppData\Local\Temp\038288d17474db91bf81b1f7a0009ffc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:1640
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2672
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2692
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2928
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:3024
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:1732
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:436
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:764
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2876
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2024
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:948
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:1540
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2904
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2852
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\038288d17474db91bf81b1f7a0009ffc.exe

Filesize
58KB

MD5
038288d17474db91bf81b1f7a0009ffc

SHA1
477bd93a617afba29f03cd023d80d980e601246d

SHA256
72944d9bceaa8c5b7fdc292536a8a84873cfa83e312d5137bcacad4154a7bd1b

SHA512
76e42a7372f646d81167af23d295eac62bdd889cbd6f94165c3fb8bc3a5023a2d5bbb2a352e71cf5bda062c3e187ef1bbee169097dc2505ed8df47390d264444

Download Submit
C:\Windowssharedapp.reg

Filesize
182B

MD5
568bbef8d7ae8d72613e1311b5c09454

SHA1
6a4116130552c5a1bfe352f491829808857c6cb2

SHA256
4ca1b9e005ccb696878960764e791ab68f1ea916ebb21776e88e1201d8501fa0

SHA512
25f990212584a50068818c994ddbcdebbcbf3f700fd1e6f5faa0e0b15608d361367434257bae13d916fa0fe5fdc6a0d257d42a4a48e91074264e689f4aa0edb0

Download Submit
memory/2000-30-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-18-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-23-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-35-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-39-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-43-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-47-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-51-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2000-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads