Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/02/2024, 15:21
General
- Target ac33fc7c45057a96802afb76f86d34de.exe
- Size 583KB
- Sample240228-srp16sef84
- SHA256 ebea8ba34240e4f689aa81673588133783ec30ac68d4a99c6633e650e5578400
Malware Config
Signatures
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac33fc7c45057a96802afb76f86d34de.exe"C:\Users\Admin\AppData\Local\Temp\ac33fc7c45057a96802afb76f86d34de.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
-
-
C:\Windows\work.exeC:\Windows\work.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IexplOrE.ExE"C:\Program Files\Internet Explorer\IexplOrE.ExE"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5036 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
uninstal.bat
work.exe
memory/3136-0-0x0000000000870000-0x00000000008C4000-memory.dmp
memory/3136-1-0x0000000002570000-0x0000000002571000-memory.dmp
memory/3136-3-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/3136-2-0x0000000002550000-0x0000000002551000-memory.dmp
memory/3136-4-0x0000000002530000-0x0000000002531000-memory.dmp
memory/3136-5-0x0000000002520000-0x0000000002521000-memory.dmp
memory/3136-6-0x0000000002590000-0x0000000002591000-memory.dmp
memory/3136-7-0x0000000002580000-0x0000000002581000-memory.dmp
memory/3136-8-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/3136-9-0x0000000002540000-0x0000000002541000-memory.dmp
memory/3136-10-0x0000000003510000-0x00000000035BE000-memory.dmp
memory/3136-11-0x0000000002510000-0x0000000002511000-memory.dmp
memory/3136-12-0x00000000025C0000-0x00000000025C8000-memory.dmp
memory/3136-13-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/3136-58-0x0000000000400000-0x0000000000558000-memory.dmp
memory/3136-62-0x0000000003510000-0x0000000003516000-memory.dmp
memory/3136-60-0x0000000000870000-0x00000000008C4000-memory.dmp
memory/4216-32-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-35-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-19-0x0000000002080000-0x000000000212E000-memory.dmp
memory/4216-21-0x0000000002080000-0x000000000212E000-memory.dmp
memory/4216-22-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-23-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-24-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-25-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-27-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-26-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-30-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-31-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-29-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-18-0x0000000000740000-0x0000000000794000-memory.dmp
memory/4216-28-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-38-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-41-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-43-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-42-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-40-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-39-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-37-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-36-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-20-0x0000000002080000-0x000000000212E000-memory.dmp
memory/4216-34-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-33-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-44-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-45-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-48-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-47-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-50-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-49-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-46-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-52-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-51-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-55-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-59-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-61-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-57-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-56-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-64-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-66-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-65-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-69-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-71-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-70-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-68-0x0000000002080000-0x0000000002180000-memory.dmp
memory/4216-67-0x0000000002080000-0x0000000002180000-memory.dmp