3f4f94d6cae5b1de5d19d710046453c3c8ead629002ae42689127af32329c5e0

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae2afff7c983f362a6bbbc89d8a13fab.exe
Size 431KB
Sample240229-lb59wsch24
SHA256 3f4f94d6cae5b1de5d19d710046453c3c8ead629002ae42689127af32329c5e0
MD5 ae2afff7c983f362a6bbbc89d8a13fab
SHA1 4aaef51e957df925e6196e08eed0455955e0b21f
SHA512 3ee67e1b18ef9a130085743ec91dc20440c24315db55457b0f6835f4673655e64565dbd24319d25b94e5abe31c34cfb8dbd8923678a8aef35e54b2177918e204
SSDEEP 1536:QgZo2b9bt6AsOho8A0jM+/Qs/Hj8sOKDNlxHNbUSZrpRi9HFcEFBxAv1qvQ:3ZoS9bc/P8ACf2ANlxHNbFrpRi8Vv1q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023265-4.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
400	calc.exe

Loads dropped DLL 1 IoCs

pid	Process
3884	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\V3smx4pnp = "rundll32.exe \"C:\\Users\\Admin\\Microsoft\\V3smx4pnp.dll\", Launch"	ae2afff7c983f362a6bbbc89d8a13fab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 400	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	100

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	3884	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe
4716	ae2afff7c983f362a6bbbc89d8a13fab.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3884	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	99
PID 4716 wrote to memory of 3884	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	99
PID 4716 wrote to memory of 3884	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	99
PID 4716 wrote to memory of 400	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	100
PID 4716 wrote to memory of 400	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	100
PID 4716 wrote to memory of 400	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	100
PID 4716 wrote to memory of 400	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	100
PID 4716 wrote to memory of 400	4716	ae2afff7c983f362a6bbbc89d8a13fab.exe	100

C:\Users\Admin\AppData\Local\Temp\ae2afff7c983f362a6bbbc89d8a13fab.exe
"C:\Users\Admin\AppData\Local\Temp\ae2afff7c983f362a6bbbc89d8a13fab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\Microsoft\V3smx4pnp.dll", Launch
  2⤵
  - Loads dropped DLL
  PID:3884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 540
    3⤵
    - Program crash
    PID:1860
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Deletes itself
  PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3884 -ip 3884
1⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

V3smx4pnp.dll

Path C:\Users\Admin\Microsoft\V3smx4pnp.dll
Size 62KB
SHA256 da3731484d90376032e9fcc26a22f14134316fd7770ab76ca1056fa01bda5bca
MD5 29f1d6b97254019cef76071697aa7769
SHA1 54b4ac864cd9deaa11b0d686211e27a7940ae9e6
SHA512 13c1d625a1c3021c4f729419ea1a93d3a63f56c67449287716bdae67ff354239ffb0c22dbf685384dbc9bc9ec7ff8232a1ae6c63f1cfe498061c304c6bef295a
SSDEEP 1536:Gx3SG95PhqsKwrMR8Fb6WabZWxvZJiKHwIcHj:kiWVAsKw95m0NwD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3884-6-0x0000000010000000-0x0000000010047000-memory.dmp

Download

memory/4716-0-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4716-3-0x0000000000400000-0x000000000046C000-memory.dmp

Download