0a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0

Analysis

max time kernel
175s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cc956e3f4befedd16d3f49ae9a269ed.exe
Size

1.1MB
MD5

0cc956e3f4befedd16d3f49ae9a269ed
SHA1

a69268d42b52acee28051af2dc97397a1e42a980
SHA256

0a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0
SHA512

21103d13232091f3a86984b32712e60b603aa63c9a2ac72bae6813f1be2ae1e2d7bdbfe6e83548ddff7941753f6281cb91a5410270834cb1f9e1c4b73bcee6e2
SSDEEP

12288:zMMpXKb0hNGh1kG0HWNAuCsltHlYzU+Wg7:zMMpXS0hN0V0HDIHyow

Score

10^/10

aspackv2 persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	0cc956e3f4befedd16d3f49ae9a269ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b000000012262-2.dat	aspack_v212_v242
behavioral1/files/0x000b000000012262-4.dat	aspack_v212_v242
behavioral1/files/0x0001000000000026-24.dat	aspack_v212_v242
behavioral1/files/0x0033000000015491-39.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
2704	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2828	0cc956e3f4befedd16d3f49ae9a269ed.exe
2828	0cc956e3f4befedd16d3f49ae9a269ed.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\K:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\L:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\O:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\I:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\V:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\Y:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\M:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\S:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\E:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\Q:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\X:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\G:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\J:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\N:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\P:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\W:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\U:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\Z:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\A:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\H:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\R:	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened for modification	F:\AUTORUN.INF	0cc956e3f4befedd16d3f49ae9a269ed.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	0cc956e3f4befedd16d3f49ae9a269ed.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2704	2828	0cc956e3f4befedd16d3f49ae9a269ed.exe	27
PID 2828 wrote to memory of 2704	2828	0cc956e3f4befedd16d3f49ae9a269ed.exe	27
PID 2828 wrote to memory of 2704	2828	0cc956e3f4befedd16d3f49ae9a269ed.exe	27
PID 2828 wrote to memory of 2704	2828	0cc956e3f4befedd16d3f49ae9a269ed.exe	27

C:\Users\Admin\AppData\Local\Temp\0cc956e3f4befedd16d3f49ae9a269ed.exe
"C:\Users\Admin\AppData\Local\Temp\0cc956e3f4befedd16d3f49ae9a269ed.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1603059206-2004189698-4139800220-1000\desktop.ini.exe

Filesize
1.1MB

MD5
240ed91d65decd95612d589dc6d7e37f

SHA1
0921665ae6e2c3c5a24ce87e93a0a15b93887372

SHA256
8f2d1ea21d1597be892668d2e9670bfae5eff737beaeb08b00c412f46907c1a7

SHA512
51978691d9dc7e0b745219c8bfed99dcef8bd55a795c6342687263fdb53b23237fcf9a90f1a115b3527f59ca03dcc9d647ab65a817f473977a720a770d896d7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
aeb60fb8963ee558ed919dba50ab733a

SHA1
e338145a890235c1eb835c1f6375bb24e234e5ce

SHA256
ff3714a3fad4eebdf6791cde68d81cfdd97461bdf58b7ddc099bc6cf059112a1

SHA512
36ef1af707f3911c45f08dae7b7d77787b21561ac0e1e4a3e7fe8df87b9077cf0c3a11e8b33eaf4ab2ffa2daab5deb1884b7be5b0e15ca46f8b355063ccec53a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
60b788561c54cb2e5603ea8887a7ba34

SHA1
08aaea001476907cc6bdb160dba1e3ea157b5ca2

SHA256
b992b9a0be154c122de7948d7575570d164e603dc630be353c5d6d8c8b11be0b

SHA512
6175a1a53bb2c1c70a096a74a40a02fa907fcbe425c3a76d1b579e2883c39360ba6c0b2e4b6a819dcd2fcb64659ec0a0289edb2eeb7915fcb0c77d5a0e6fdacf

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
1.1MB

MD5
0cc956e3f4befedd16d3f49ae9a269ed

SHA1
a69268d42b52acee28051af2dc97397a1e42a980

SHA256
0a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0

SHA512
21103d13232091f3a86984b32712e60b603aa63c9a2ac72bae6813f1be2ae1e2d7bdbfe6e83548ddff7941753f6281cb91a5410270834cb1f9e1c4b73bcee6e2

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
1.1MB

MD5
7930f19c44280f3b5228bff5bb968ce5

SHA1
a4e04359fb5c6e5f59f6881109f58ea6c32ed5d4

SHA256
4cd5b7e79c9958a711b425aeb9e37886c7c9f56bb5e4b708d3b480cd071f39be

SHA512
2347f8539d59119cd80eae40993110c56d54cd51612dec3918bd587720fbf1e8a22903db7afe0711fe4dfa3db7f697277c846c778bccf3a4f841a46e4d612656

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
885KB

MD5
8bd7754b0d8e891647c879e3f0c01c0a

SHA1
7b503e9ab640e21b0c6fa7401b80db09fc2fb4f0

SHA256
f216cceea18b8674b9742dab6f586282c551ed57ab7756530394e3ebf1973557

SHA512
633eabe58a264de833190f322d5ffb27656194932648f8eb22b0b687f242b919f2f000d44a94412ac434ebfe93161aa0d7cb21b4549e4ef3fe905add99b5232c

Download Submit
memory/2704-9-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2704-239-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2828-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2828-238-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads