Analysis

  • max time kernel
    175s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 03:21

General

  • Target

    0cc956e3f4befedd16d3f49ae9a269ed.exe

  • Size

    1.1MB

  • MD5

    0cc956e3f4befedd16d3f49ae9a269ed

  • SHA1

    a69268d42b52acee28051af2dc97397a1e42a980

  • SHA256

    0a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0

  • SHA512

    21103d13232091f3a86984b32712e60b603aa63c9a2ac72bae6813f1be2ae1e2d7bdbfe6e83548ddff7941753f6281cb91a5410270834cb1f9e1c4b73bcee6e2

  • SSDEEP

    12288:zMMpXKb0hNGh1kG0HWNAuCsltHlYzU+Wg7:zMMpXS0hN0V0HDIHyow

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cc956e3f4befedd16d3f49ae9a269ed.exe
    "C:\Users\Admin\AppData\Local\Temp\0cc956e3f4befedd16d3f49ae9a269ed.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1603059206-2004189698-4139800220-1000\desktop.ini.exe

    Filesize

    1.1MB

    MD5

    240ed91d65decd95612d589dc6d7e37f

    SHA1

    0921665ae6e2c3c5a24ce87e93a0a15b93887372

    SHA256

    8f2d1ea21d1597be892668d2e9670bfae5eff737beaeb08b00c412f46907c1a7

    SHA512

    51978691d9dc7e0b745219c8bfed99dcef8bd55a795c6342687263fdb53b23237fcf9a90f1a115b3527f59ca03dcc9d647ab65a817f473977a720a770d896d7a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    aeb60fb8963ee558ed919dba50ab733a

    SHA1

    e338145a890235c1eb835c1f6375bb24e234e5ce

    SHA256

    ff3714a3fad4eebdf6791cde68d81cfdd97461bdf58b7ddc099bc6cf059112a1

    SHA512

    36ef1af707f3911c45f08dae7b7d77787b21561ac0e1e4a3e7fe8df87b9077cf0c3a11e8b33eaf4ab2ffa2daab5deb1884b7be5b0e15ca46f8b355063ccec53a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    60b788561c54cb2e5603ea8887a7ba34

    SHA1

    08aaea001476907cc6bdb160dba1e3ea157b5ca2

    SHA256

    b992b9a0be154c122de7948d7575570d164e603dc630be353c5d6d8c8b11be0b

    SHA512

    6175a1a53bb2c1c70a096a74a40a02fa907fcbe425c3a76d1b579e2883c39360ba6c0b2e4b6a819dcd2fcb64659ec0a0289edb2eeb7915fcb0c77d5a0e6fdacf

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    1.1MB

    MD5

    0cc956e3f4befedd16d3f49ae9a269ed

    SHA1

    a69268d42b52acee28051af2dc97397a1e42a980

    SHA256

    0a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0

    SHA512

    21103d13232091f3a86984b32712e60b603aa63c9a2ac72bae6813f1be2ae1e2d7bdbfe6e83548ddff7941753f6281cb91a5410270834cb1f9e1c4b73bcee6e2

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    1.1MB

    MD5

    7930f19c44280f3b5228bff5bb968ce5

    SHA1

    a4e04359fb5c6e5f59f6881109f58ea6c32ed5d4

    SHA256

    4cd5b7e79c9958a711b425aeb9e37886c7c9f56bb5e4b708d3b480cd071f39be

    SHA512

    2347f8539d59119cd80eae40993110c56d54cd51612dec3918bd587720fbf1e8a22903db7afe0711fe4dfa3db7f697277c846c778bccf3a4f841a46e4d612656

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    885KB

    MD5

    8bd7754b0d8e891647c879e3f0c01c0a

    SHA1

    7b503e9ab640e21b0c6fa7401b80db09fc2fb4f0

    SHA256

    f216cceea18b8674b9742dab6f586282c551ed57ab7756530394e3ebf1973557

    SHA512

    633eabe58a264de833190f322d5ffb27656194932648f8eb22b0b687f242b919f2f000d44a94412ac434ebfe93161aa0d7cb21b4549e4ef3fe905add99b5232c

  • memory/2704-9-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2704-239-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2828-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2828-238-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB