77fe6df24659b51f5c2e9c8bfc19775df7f6242c97bf7baa4386fc6fd645d3a2

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9841366560657ff68cc3d50ad4345a1b.exe
Size

1.9MB
MD5

9841366560657ff68cc3d50ad4345a1b
SHA1

84fcf5f92f87c6e4108246ee2be5e60004440c6f
SHA256

77fe6df24659b51f5c2e9c8bfc19775df7f6242c97bf7baa4386fc6fd645d3a2
SHA512

f6353b026fcd08427c50a79706adee4c9e557efd0ef6027b5c9b67970071a4f9fa988f6ad070a46bee091721459fbed70333b555df4b4e0b56c98c449a458c4a
SSDEEP

12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyG+49:RJcu8pl9d+VdCUhN1SsNK+1pSyP49

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	9841366560657ff68cc3d50ad4345a1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	9841366560657ff68cc3d50ad4345a1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	9841366560657ff68cc3d50ad4345a1b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	9841366560657ff68cc3d50ad4345a1b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	9841366560657ff68cc3d50ad4345a1b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	9841366560657ff68cc3d50ad4345a1b.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000e0000000122dc-24.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
2312	fservice.exe
2804	services.exe

Loads dropped DLL 6 IoCs

pid	Process
1536	9841366560657ff68cc3d50ad4345a1b.exe
1536	9841366560657ff68cc3d50ad4345a1b.exe
2804	services.exe
2804	services.exe
2312	fservice.exe
1536	9841366560657ff68cc3d50ad4345a1b.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	9841366560657ff68cc3d50ad4345a1b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fservice.exe	9841366560657ff68cc3d50ad4345a1b.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	9841366560657ff68cc3d50ad4345a1b.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\sservice.exe	9841366560657ff68cc3d50ad4345a1b.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	9841366560657ff68cc3d50ad4345a1b.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe
2804	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2804	services.exe
2804	services.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2312	1536	9841366560657ff68cc3d50ad4345a1b.exe	28
PID 1536 wrote to memory of 2312	1536	9841366560657ff68cc3d50ad4345a1b.exe	28
PID 1536 wrote to memory of 2312	1536	9841366560657ff68cc3d50ad4345a1b.exe	28
PID 1536 wrote to memory of 2312	1536	9841366560657ff68cc3d50ad4345a1b.exe	28
PID 2312 wrote to memory of 2804	2312	fservice.exe	29
PID 2312 wrote to memory of 2804	2312	fservice.exe	29
PID 2312 wrote to memory of 2804	2312	fservice.exe	29
PID 2312 wrote to memory of 2804	2312	fservice.exe	29
PID 2804 wrote to memory of 2704	2804	services.exe	30
PID 2804 wrote to memory of 2704	2804	services.exe	30
PID 2804 wrote to memory of 2704	2804	services.exe	30
PID 2804 wrote to memory of 2704	2804	services.exe	30
PID 2804 wrote to memory of 2872	2804	services.exe	32
PID 2804 wrote to memory of 2872	2804	services.exe	32
PID 2804 wrote to memory of 2872	2804	services.exe	32
PID 2804 wrote to memory of 2872	2804	services.exe	32
PID 2704 wrote to memory of 2000	2704	NET.exe	34
PID 2704 wrote to memory of 2000	2704	NET.exe	34
PID 2704 wrote to memory of 2000	2704	NET.exe	34
PID 2704 wrote to memory of 2000	2704	NET.exe	34
PID 2872 wrote to memory of 2732	2872	NET.exe	35
PID 2872 wrote to memory of 2732	2872	NET.exe	35
PID 2872 wrote to memory of 2732	2872	NET.exe	35
PID 2872 wrote to memory of 2732	2872	NET.exe	35

C:\Users\Admin\AppData\Local\Temp\9841366560657ff68cc3d50ad4345a1b.exe
"C:\Users\Admin\AppData\Local\Temp\9841366560657ff68cc3d50ad4345a1b.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\fservice.exe
  C:\Windows\system32\fservice.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\services.exe
    C:\Windows\services.exe -XP
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP srservice
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        5⤵
        
        PID:2000
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP navapsvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        5⤵
        
        PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
80df15e3ab65fd6dfb7c3f8ed4e078df

SHA1
94fe142af799acdcb18310f3ff06a67c3ca9d235

SHA256
d12346bb0049c6a257834f8ba835b7e43ec59bfed550264ea0f545a8d29829de

SHA512
f34675945d43f12274d37f82031a281814a0f698c9eedb9e7894cd4d7f7bf00d8f6ff154c52318eea9d12a6515e6a95ccbc00d3eb6f8e6cd556691ce57f8cdf4

Download Submit
C:\Windows\system\sservice.exe

Filesize
1.2MB

MD5
1b693c7edfa8eb13d16fd0462637417b

SHA1
46a81bd2e0166ebf21555e62186c5e2b6c50c2c3

SHA256
10bae970a821c30ea1783dc65a29f09a32c95d1f6d20241c633bfb5082576986

SHA512
a5d05a9f62c8448290107ad252f3e418fda8c6885bb61ed4e7d289ca3f0196efda2a16fa6b16116fba519f90ac9f9ec643759077a22aaca220af2cdf6b25a11a

Download Submit
\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
9841366560657ff68cc3d50ad4345a1b

SHA1
84fcf5f92f87c6e4108246ee2be5e60004440c6f

SHA256
77fe6df24659b51f5c2e9c8bfc19775df7f6242c97bf7baa4386fc6fd645d3a2

SHA512
f6353b026fcd08427c50a79706adee4c9e557efd0ef6027b5c9b67970071a4f9fa988f6ad070a46bee091721459fbed70333b555df4b4e0b56c98c449a458c4a

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
562e0d01d6571fa2251a1e9f54c6cc69

SHA1
83677ad3bc630aa6327253c7b3deffbd4a8ce905

SHA256
c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6

SHA512
166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

Download Submit
\Windows\SysWOW64\winkey.dll

Filesize
13KB

MD5
b4c72da9fd1a0dcb0698b7da97daa0cd

SHA1
b25a79e8ea4c723c58caab83aed6ea48de7ed759

SHA256
45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

SHA512
f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

Download Submit
memory/1536-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1536-36-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2312-33-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2312-12-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2804-38-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2804-48-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-37-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-22-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2804-39-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-41-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2804-42-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-44-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-46-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-26-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2804-50-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-52-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-54-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-56-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-58-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-60-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-62-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/2804-64-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download