61ac059ad699c3c246fb9bc934d6d89e00e91c086e5253f64f79199101b1f0c0

Analysis

max time kernel
145s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ba238d50e594b0c0cb6e26f1b9e626b.exe
Size

772KB
MD5

9ba238d50e594b0c0cb6e26f1b9e626b
SHA1

29c89e7b2c7b1d957d452477a79eb326615550e9
SHA256

61ac059ad699c3c246fb9bc934d6d89e00e91c086e5253f64f79199101b1f0c0
SHA512

d8fb0312f234e7e7555fdf221756dfb975d5afd5581bdf15878b26de07cba6b08367e4d1b83168269a6923a7bb764ac90a50ce25112ea640b99ffad44e6f57b7
SSDEEP

6144:LiMmXRH6pXfSb0ceR/VFAHh1kgcs0HW1kyApHhP+gDzvRicLLvo489aA1b4oTqMi:5MMpXKb0hNGh1kG0HWnALbS4oxAl

Score

10^/10

aspackv2 persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	9ba238d50e594b0c0cb6e26f1b9e626b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000122c9-2.dat	aspack_v212_v242
behavioral1/files/0x0035000000016cb3-38.dat	aspack_v212_v242
behavioral1/files/0x0001000000000026-61.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	9ba238d50e594b0c0cb6e26f1b9e626b.exe

Executes dropped EXE 1 IoCs

pid	Process
796	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2512	9ba238d50e594b0c0cb6e26f1b9e626b.exe
2512	9ba238d50e594b0c0cb6e26f1b9e626b.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\K:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\S:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\Z:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\L:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\H:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\I:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\N:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\B:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\G:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\J:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\Q:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\V:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\Y:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\E:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\P:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\T:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\M:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\O:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\R:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\U:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\W:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\X:	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened (read-only)	\??\W:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened for modification	C:\AUTORUN.INF	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	9ba238d50e594b0c0cb6e26f1b9e626b.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 796	2512	9ba238d50e594b0c0cb6e26f1b9e626b.exe	28
PID 2512 wrote to memory of 796	2512	9ba238d50e594b0c0cb6e26f1b9e626b.exe	28
PID 2512 wrote to memory of 796	2512	9ba238d50e594b0c0cb6e26f1b9e626b.exe	28
PID 2512 wrote to memory of 796	2512	9ba238d50e594b0c0cb6e26f1b9e626b.exe	28

C:\Users\Admin\AppData\Local\Temp\9ba238d50e594b0c0cb6e26f1b9e626b.exe
"C:\Users\Admin\AppData\Local\Temp\9ba238d50e594b0c0cb6e26f1b9e626b.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3601492379-692465709-652514833-1000\desktop.ini.exe

Filesize
773KB

MD5
915eb14170892834f41828947a07c409

SHA1
ba5d806d5fef9b9a78b35b9f5b452ce5efc5aff1

SHA256
f5fd1cf9abf194bfc10ea25e11b681138f1313d49f7ae1ff420f7fb9c27ab70d

SHA512
af1f463a12f94798a173f2892b9d8517dfd5e5665a809f28f6519dd530a83278e30c341bd09bbba85228d79163753a27bac6fe771fd7e1cef1f005b97227cb30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d85889422d61d21be122f1fb2ec82e07

SHA1
dea02dcbadbe4e01bbefa5298c30f34b5480b10b

SHA256
20d67c9c38da8cee884a22888b3fb3bdf3b00fc2544cecb6fecafae937fa89db

SHA512
3090871cb580398f177a21ab90f4c464ddfa9387b8d5f8ce56e86c82e49685995e266585c8f087ceb2f7ec694819a667363b71110215424244d50fb2442f8c47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
3a06bd20085608d6088115e8f358affa

SHA1
88c85f6917407e5fc06860fe274159f256a98489

SHA256
7ba56bd05f2f98fc5c6657c9e2d47a59e31299d67b3a40b810fade8066222fc3

SHA512
2dce72b40fdf51d2ad233233af21ffc245db713acc94d4190390a5dede54e2fe4047feecfeb9a2f519fc32d8aea3c84cf5d17d32386d846e99c28475a5e1252d

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
772KB

MD5
9ba238d50e594b0c0cb6e26f1b9e626b

SHA1
29c89e7b2c7b1d957d452477a79eb326615550e9

SHA256
61ac059ad699c3c246fb9bc934d6d89e00e91c086e5253f64f79199101b1f0c0

SHA512
d8fb0312f234e7e7555fdf221756dfb975d5afd5581bdf15878b26de07cba6b08367e4d1b83168269a6923a7bb764ac90a50ce25112ea640b99ffad44e6f57b7

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
693KB

MD5
3cca3cabf0404defa009a366af3ed8cc

SHA1
f88df448d893bb924a5c9ca2232eeb933e9a91f4

SHA256
f32a194025b08e3da9e5245ab56638b89428f3097a0baf6ff8cd98763c63a17b

SHA512
aedb78122e67a9db8b9b33cd3e14c344cf304ef3b5f945652d3f6383873018f9d749184261402f02ac0eac93f43e1a1712bef75e9a5d20407df822e0ef5682db

Download Submit
memory/796-9-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2512-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2512-240-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads