Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 20:41
General
-
Target
1c08f54a193c4a792ef1d8620576724d.exe
-
Size
7.2MB
-
MD5
1c08f54a193c4a792ef1d8620576724d
-
SHA1
3a335e256a7f14e649bd6dd78815aaa037e94693
-
SHA256
2fe2dfa7fdf3333ac8ffeac51e915a9ca81b2cbed313aa9e21fa1582b58900c3
-
SHA512
33556951e82eec11298440068bc32354878832869b677a99eae41d79203a2adc739f4e5370b2f75f0a26d01d23de87dff0bad5041ce7c0116139056a870bf9f9
-
SSDEEP
49152:Kwi0L0q+wi0L0qRDB8NIMI8Sfpwotkzaxc1OGz8mB8NIMI8Sfpwotkzaxc1OGz8g:Vi0fi0HEIMzKpXOMGQjIMzKpXOMGQg
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c08f54a193c4a792ef1d8620576724d.exe"C:\Users\Admin\AppData\Local\Temp\1c08f54a193c4a792ef1d8620576724d.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD509a43b3b72e2faf0d558bb8e33269493
SHA1955709f9e4a7b209f0297c8659ccdc194f826439
SHA256d15397f464fa33c4a1369ac55efe70a11a6713dc1474a6d090914719bb0c247e
SHA5121d881389751d349496b9fc0587a0643da9ba329ab5b8165a74048396a47573ab807896ea0904db971913c7c21f0f07df8013c01a90b2bae21633b6651ff24cbd
-
Filesize
1KB
MD54aa626c4ae1ce4c792c0bed40dd6dd19
SHA184cf6514708e69fc0151016acd9b7716b163a365
SHA2563a02621e43d12b0f0e92b5bbd2c37cd718b6478e108a1b8d152d017ff8963522
SHA512f3dddb54456df4461ac250f5616e164e125a30857cb44242d846c5cf6ea90e540bb17205cb5b03fe6cceaeb72ea5970deffd4fcc0e75a3c80891575c3a923d48
-
Filesize
950B
MD5fffe13cf613d5e21304237396053ff87
SHA11f831435367a1ffe4f3b92984bde47242dceb676
SHA256015c3cd8461955f9fa9211a80e67dbde0a89166ead05c3a0a1bb6d73a68e9893
SHA5122de5de1d7aab9f8e00390c935f4953343e50c5ded5a39fe8553d07fde3e2c0c120b229ca9d57f77eaea37928c46f23f2e48b679d4297c26447522c8adcf029d5
-
Filesize
1.7MB
MD51208b5afb0ac122a2b717fcc2ec73c39
SHA14b064421bc9de9dc927507e3ab96f451135a466c
SHA25610d4d65db6357e472c7aa267ec2d60532a759cf7067ea3c47f675f222e307f2f
SHA5123f2727e889eafe8f750207cee6f24e8b8bcca15330578bdf7898357f5692cf2b9a709db613b4f6ddb992cb050e81abc3a9acc519f0b8f333afb61b82684195d8
-
Filesize
1.9MB
MD57dcd9e5ccf23912af816fab051193a95
SHA17739586a01bf8c738090a2ffc6e63ee46290e364
SHA25689e510b1424544a00c63ba4f408cab7dfd4f04e1450d3a11ee62d65a32787656
SHA5126cb9c1e2c9746da2ab7d12d77f09fd759ad834d18d811501ff43d977751f01bffae6737083c6e68398f32caa364cc1e5280774f66ea390310f9faaaf4700e3dd
-
Filesize
2.0MB
MD5abffa38317b1b0b42fb319357a795b7c
SHA1f771057a9b96ca72cccfe1c6cd4e80b2619f811a
SHA256ef46c5335372846ed9997e0aee5376e4c4393235835bf819d97e6a7b58038747
SHA51264a768e506c59924b76db3b3bca2ff3ff97b749ced04f475509ae4fff14905b7f774e8c41ca762ec576005d91997efb77d1d34c10d7fc48357779965d376d4bc
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
2.3MB
MD5d3e202ebb4c67e04be8c5c1767eb22d0
SHA1a234f84bfa0ca10b9bec11079d361dd39112fa5c
SHA256a9a6fe7d07c9fd318e11a023a52ea43778ddd12c064fe750308a68b3ac6e42c7
SHA512b459fab64853fc2298fbb20f25272ba3e7a07c3cac4f717fb0ed0d2998d7d66bb6b9184123abf75ceb2375f299c2593859f436c7795240f7fd1a74845a8d69ce
-
Filesize
4.1MB
MD547de4f9b68a9be73ce37abaf677d6bc1
SHA14622406b24959282b1360dca4879665a808f3d6e
SHA2560393f2c81bf6e0edee694237fa23f311c481cef2edd3b452f9c31184fbf62dbd
SHA512e40ffb56ec650d2c98039eebbf73ee7ca70e1f2156922d8582fd4942b824299ae298a8044fde27fec0cfd4ef1b2d70b18e6888c29d58f384b8e72536d295511c
-
Filesize
2.0MB
MD5d6212badfb7511b8e8a36c2622b40485
SHA122ebd7e2b6d964a8d0dbe795e92093a6ec56f0c2
SHA2565be678a7bc2e2bc2ce131b8b74c85b55cfc1989455b90116c8c5dbc0cbaed5ee
SHA5124faf810d83d3c9601b1ee581f110c4e2eb1b029f41d0f24518832decc22040a322ebfe5393fac5c1727845be76d03f877650da731eab06e5f5dca1d69a2ad442
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
480KB