Analysis
-
max time kernel
143s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21/02/2024, 14:44
General
-
Target
PAssist_Std_20240217.10111503.exe
-
Size
73.3MB
-
MD5
a8574a9a3ead8a8f0e26955698bafa93
-
SHA1
c5e4e1beb1590505768ee7cab435835324a66607
-
SHA256
3bb97eb87e38a4e7e9a037be0cdacc9b67a433629d24b4f32c73b425becc35f2
-
SHA512
df477db1ca7f4a1d1ebcba562315a480b7ffb51f1abe9155e6ec6646a7f648240f8c4dbf2a3994ee0c0a182dbe2fd7b8e599bbcc0b3d85fdbcce58fbb34f8598
-
SSDEEP
1572864:cUZRl1fBDePtw08BaHHVpUfoSnh7673yWXvb4ysZyZZT+VmkByCT9kZ:RZRl1ZEtw0nrUvnk73yWfb4ysZyZkyCA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 41 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAssist_Std_20240217.10111503.exe"C:\Users\Admin\AppData\Local\Temp\PAssist_Std_20240217.10111503.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8RVCI.tmp\PAssist_Std_20240217.10111503.tmp"C:\Users\Admin\AppData\Local\Temp\is-8RVCI.tmp\PAssist_Std_20240217.10111503.tmp" /SL5="$7006A,76191558,619008,C:\Users\Admin\AppData\Local\Temp\PAssist_Std_20240217.10111503.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-V457I.tmp\aman.exe"C:\Users\Admin\AppData\Local\Temp\is-V457I.tmp\aman.exe" -Cookies3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 21043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1328 -ip 13281⤵
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" SYSTEM1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dashost.exedashost.exe {ea6d9106-b21c-4b51-84982f7d6ae28c1d}2⤵
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\MergeRedo.avi"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD55365d92452967516bbfea696fb767c6a
SHA14be412e572ee9f01f60fe63ca6cf40bea393daea
SHA2569c916bb9f92446d3c91dae7a8a58b75d3e29e372dfd9347ffae15b6d6def0d4e
SHA512d2b8dd5f8698af3643227680a0c79a5351033f425a00dc1f6fdf234e6988fac26649a75e9ba417b8ceaf3cba9c718902ba67d8df4bbbcaa98d5714c77ffb0722
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
72KB
MD55f7de6775125b31caaa0edec7b8f2ad3
SHA1a8f7a8ee6ce4eb8c7faa97b222b404e25604be5b
SHA256bd83b596384b414ae4f2f9adfb0b80b2231572df12ee32a80647aaf92abe575c
SHA512ed6c959ddd936962ddb34a13f129d0f2a0943ba12797944b6f57febeb0cf60e1c081028af1438d439fceafcb0ee1b0462fa12ab78b41a833aff8ac9fd3f1f8dd
-
Filesize
51KB
MD572d01e07655ef01c7cf94dd01e627323
SHA1956b802ac2aa02cdc49f4308168f1521e9d321f4
SHA25642518c27b53e430c15efdacfb06672cccd68b675be21835b06b076689a6a45d5
SHA512b2541d6c5edd4cde9fbb4ff38ae24956857c168d34b9be09d7e3227f23bcfaf8c269e29944724d00edc5f9c164fe410a8c43af47c254b68052692552bc8ada2d
-
Filesize
228KB
MD50e11aaf2f9c945b52e2f3527e5f81980
SHA15015ebd963919ab93a12848d666d5c61c0706513
SHA25682eeea52144ddbc119ea5653ed53c4c9bc2f19ca20461fdfb83aa8bf6d4f6004
SHA51259b54cb8fbbc42ee0f740d0314dd51556791e21e0fb44b63f980404351e7433bd80a061e2df769744b62924cf5fd90616f25f92ae7c8720f77672f5bcd1da874
-
Filesize
565KB
MD588a3e7ae3b30d459280708e030c2a8ad
SHA1af43b706dd964be1fdd5f3a2b3ff36835ce867ee
SHA256777180a294273daf2605a7abec13b5f63cebb80f87f7c0a1948f672c2b138261
SHA5124443daa1ea65a96835a6551c8f2db1edaff9e9d38e7049241d3995aeaa5ec4278d38a2f756f5f5fa1a057297635b599416a6e758e14d928272630ff812606ca5
-
Filesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
Filesize
137B
MD5ece0524c346240947640289ebaaf5a83
SHA1b588f039b2ce34ae51c30d5fc6bae7a91c639c8a
SHA256b4a667f9a966d6cd35a8bbf76ed849ead7b14dfe08ce4f149f8c17809418ca99
SHA512ef38ed18f5e9521c1f0faf38d0553fedc8aeea00d82ffefe041698ccfdb5ee6bbcc5cf7dcce3be7a63aebd825771b0cad38a9717c88d18323a13a1bc34d87cfc
-
Filesize
1.1MB
MD5da486cfa746ca1570b485195d1193ba3
SHA124d19b1446433c9cd57d03edc8cac526e28672b1
SHA25616f88398f5b0c7da52466fda38f0dbcbbe4980504b8041022bf424336c0c512c
SHA51213281a973fe3ed02f882ce3712622152cde52b436654addc060bb5f82c14ed91ed957f799f2f41a6a18816fafde04b13529d81d061ca474697ad1c7e06f444de
-
Filesize
35KB
MD50177746573eed407f8dca8a9e441aa49
SHA16b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA256a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
SHA512d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
-
Filesize
274B
MD53a58934b887aab94f6b08f937379cd27
SHA11b56a9405cc8b818c4c2584372d30ff2e3f07173
SHA2562412f5c1a826c923b6afbf41aa700066f8845227bc6c0732f1917f4671e16015
SHA512f5232174b1c4c3871fbc0fbcab403d2281f8d2c207127466d215de44b23d4472e5dee32210e3adf2294a9be31b334e0dae14f0421ee05318ed419239bcb983d4
-
Filesize
375B
MD55577c4f4a5b74020337c273b94744d25
SHA146c46b1d15a07319d7396e9ab1bd686764abf785
SHA2568e9e7818db8b22e2d7e836ae72712eb402b4e94fc43aa1b2a6b1217dfb90e9ac
SHA5123cd31fc686103a83ce8779fc94771b51afbf1343f5ab4e36f3f2d1ede013feb6eb4b0d66c48c5f00217eefb9c407071fd30188dc0a16244d86899116c6fc4f45
-
Filesize
129KB
MD511ae2b6d5f4afb3a4c9edb1939d59606
SHA102a42ec515b68593d6c1827e7518393bd9c7b7e0
SHA256af0ecad803372b0350941bf55c246d8061a6826bb4ac6abcfb6978fa3f907906
SHA5122bf921f6600eb8b63b237da8979ac27ef5552cc6524aa9d50cc0e630d582ad127d78c8856e703dc6ed351c2ddcc614c2536b285209445646e1c2bb4ea0711e68
-
Filesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
Filesize
140B
MD52f1b4ef6b5c3dd2174030eca6f402ba2
SHA1c15580e3dcc711a77d290d0c57036249b527a6d5
SHA256d7c73c8deacc5d6ebd2ab64834a915bd02040b357eb0e325300232751270b7d3
SHA512f7f5e43a688baf360beb710b46ed0386740f6c4056a33204168b0ee8884e446ed0c9079fd4fdbbdc181d22ed5dca122ae2f0ccf361a2dce076792d58aa32c05c
-
Filesize
8KB
MD5d0372bedb70710aeff382818ad683f54
SHA1f960deffdde9cd5cb5fd3608185a49a91d398f3e
SHA256b3daff58c8e7ca8ce6fe155ca78c681a7d3144a538c3ed4c2913e91a1d2bd717
SHA5124b24a990ba155b664bad58884810123898f99f3ffe3d9704662c9576d31d60f1889c7a368589af7c3c9559e5fb9921cf87bc4faf73b4b83d1262b50c9bb5f706
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
1.1MB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
644KB
