Analysis

  • max time kernel
    146s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 02:27

General

  • Target

    ad742104f5da2b146e926f1eab741103.exe

  • Size

    2.9MB

  • MD5

    ad742104f5da2b146e926f1eab741103

  • SHA1

    0f8ddc0bf413c54159752ec412546ac8794a6819

  • SHA256

    7de456532b87725cb5be6a3b13d4859c1b3d0fcd220b1935741373b567c8803d

  • SHA512

    ca4ce3da260debbc9a87b7ff9e03f81bec5641e6eed36b27f24d9c900a749214b81f49686a72c8ae66b66f0d9a47ad1084cf235b6f2a9cf76744ec9802fd7dd9

  • SSDEEP

    24576:ZMMpXS0hN0V0HZSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0Ns:Kwi0L0qk3

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad742104f5da2b146e926f1eab741103.exe
    "C:\Users\Admin\AppData\Local\Temp\ad742104f5da2b146e926f1eab741103.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:280

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini.exe

          Filesize

          2.9MB

          MD5

          8bb5f37966997b090b3597a413d91cd4

          SHA1

          9f4040787d306f302aaf29929bbcc1c5ea912b6a

          SHA256

          0768e092a31c70f89bd03251783a0f28c99e3642624c98b7d5465fea75ebc266

          SHA512

          9d8e9bdab84f9918fc10a02703479a1c38fcbc6d779dc2dca643fafe7978db8110831816a9adc6197695165beca81943934e0bc41f35d05752bfd89c221214f2

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

          Filesize

          1KB

          MD5

          9dc02a3664597e6b8f2c70067a2da226

          SHA1

          29910a232eed37ba8b49823e71e1cbbbbf975fbf

          SHA256

          5809238c5cb8f48877ad57ed2c7597192609e354c156f97bf7db6ad99a6f681d

          SHA512

          9295240707c4d1d3c0be616d2f3b9c01d8c74fc920a62bcb0947f33e3366fea632c4ae2d1f5d95f6c9b6bebe053e591c4f52779ec859628d4e58769c6459e2f4

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

          Filesize

          954B

          MD5

          bc1a4e82d2149ed5aa20fa6aa584a536

          SHA1

          130ce2f53c382591d30dcfb4da08bd5b862e8853

          SHA256

          66d2d23156979927f4a832845cd2d477b081c53ec35905ae584f8a5e8e26412f

          SHA512

          93542c758de71a100acd8e536a55b659699cd1c4223165e1029f458bc4acd50033961ad4169bb3119bb321af036b6dd3c3bb66878939c6266b6f78703d713823

        • C:\Windows\SysWOW64\HelpMe.exe

          Filesize

          64KB

          MD5

          6df66513d010e726e8bab7ea168a3b2a

          SHA1

          056b838ff2c8dab9929726eaba3f62e310369850

          SHA256

          5ccad7e623d4172d29561f039f31866d5a7e4c1361ee83cf848eff53182ef1ba

          SHA512

          a70258dadb3004dd2dff7ce02d2682374fe714117d6991f66870b595707e03ff938d08c2dbc2d32ea76aa7c54ff7dd9fc29dbd0bcffc2bf53d7a02cadb52eb1a

        • C:\Windows\SysWOW64\HelpMe.exe

          Filesize

          1.1MB

          MD5

          cf98708a8528d5558fabd25bc8b0a90d

          SHA1

          f7b1523417093d83a73f055edebd61834353102c

          SHA256

          a90f2bce8eb9442e2c02aa1df363c180b6e44d4514eee0faf36568fa85e9e527

          SHA512

          71238efb548608692722136491d71bd094ddbbd4672e468eab321cce18d7c3f6302360bfe319eca65e827c65716975aa6123f794acc3befc2ef255150f970c10

        • F:\AUTORUN.INF

          Filesize

          145B

          MD5

          ca13857b2fd3895a39f09d9dde3cca97

          SHA1

          8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

          SHA256

          cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

          SHA512

          55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

        • F:\AutoRun.exe

          Filesize

          2.9MB

          MD5

          ad742104f5da2b146e926f1eab741103

          SHA1

          0f8ddc0bf413c54159752ec412546ac8794a6819

          SHA256

          7de456532b87725cb5be6a3b13d4859c1b3d0fcd220b1935741373b567c8803d

          SHA512

          ca4ce3da260debbc9a87b7ff9e03f81bec5641e6eed36b27f24d9c900a749214b81f49686a72c8ae66b66f0d9a47ad1084cf235b6f2a9cf76744ec9802fd7dd9

        • \Windows\SysWOW64\HelpMe.exe

          Filesize

          2.9MB

          MD5

          384ab83d8ed3c45c36d60d29741464eb

          SHA1

          2597285c83a7c9d358c939fc5a8ef06e5cc57583

          SHA256

          eb53033b855dab1f328d6d188fda583a6e6c1e06527eb8cf755a253df2f4cf32

          SHA512

          3bce8af44e0bdc91c275494750ed691ca5608c099057d7d79058c0d6f3cf391933f6dcdd00e726af91889d9a4ec94b10e8f9dda31fb6ee0a81289acd680c9015

        • \Windows\SysWOW64\HelpMe.exe

          Filesize

          1.4MB

          MD5

          9ddb0a95e58947e15e12fc6763b192f5

          SHA1

          e0f7aa244a07c98504134a19c4ff7873d5ab6c42

          SHA256

          d0c87acb23c9b4b754636f5e425a9596250318680b6731ead6d873d0e82e269f

          SHA512

          7fc0b19d777deb83b3e058d09f01e84dd28efc0e7748b111384b346cfc15724cdc85f7fab42fb43516fe44663a6eea561c43c9186992b6621824f0244f53ef44

        • memory/280-260-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-322-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-73-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-9-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/280-362-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-239-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-350-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-340-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-250-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-332-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-310-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-300-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-270-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-292-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/280-282-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-331-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-259-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-299-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-269-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-309-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-0-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/2940-281-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-321-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-291-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-72-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-339-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-249-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-349-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-240-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/2940-361-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2940-238-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB