d1b5f108d5cbf5777654644a84cd5fe94d7759756608e2ab8d6f1885827b4de5

Analysis

max time kernel
116s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae2b9d5ae1c167049fff923ee07daadd.exe
Size 57KB
Sample240229-lc68ksch43
SHA256 d1b5f108d5cbf5777654644a84cd5fe94d7759756608e2ab8d6f1885827b4de5
MD5 ae2b9d5ae1c167049fff923ee07daadd
SHA1 ff1b121f503a595a9b684c8ae08abe7136e71468
SHA512 097cd09dd8a0bc93bf1265f29fec9898f6e15a762e6c0f4ed3825630ec668554882147d05f2f4d7f8d496843fc18e63b0d945d5a29a67a960184a131a99d831a
SSDEEP 1536:MysuehEDH9XsPxSyBUFrV11hag0BlsKDesE7EyP+q4mSGE:MjqeJ7BU7xOBlsNsdyx45GE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\swasmx\parameters\ServiceDll = "%SystemRoot%\\System32\\ruygcg.dll"	ae2b9d5ae1c167049fff923ee07daadd.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\swasmx\parameters\ServiceDll = "%SystemRoot%\\System32\\ruygcg.dll"	ae2b9d5ae1c167049fff923ee07daadd.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\swasmx\parameters\ServiceDll = "%SystemRoot%\\System32\\ruygcg.dll"	ae2b9d5ae1c167049fff923ee07daadd.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023333-6.dat	aspack_v212_v242

Loads dropped DLL 4 IoCs

pid	Process
4240	ae2b9d5ae1c167049fff923ee07daadd.exe
3988	svchost.exe
3988	svchost.exe
3988	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0005f215.ini	ae2b9d5ae1c167049fff923ee07daadd.exe
File created	C:\Windows\SysWOW64\ruygcg.dll	ae2b9d5ae1c167049fff923ee07daadd.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
560	3988	WerFault.exe	96
224	3988	WerFault.exe	96
1956	3988	WerFault.exe	96

C:\Users\Admin\AppData\Local\Temp\ae2b9d5ae1c167049fff923ee07daadd.exe
"C:\Users\Admin\AppData\Local\Temp\ae2b9d5ae1c167049fff923ee07daadd.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:4240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k swasmx
1⤵
- Loads dropped DLL
PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 528
  2⤵
  - Program crash
  PID:560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 808
  2⤵
  - Program crash
  PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 616
  2⤵
  - Program crash
  PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3988 -ip 3988
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3988 -ip 3988
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3988 -ip 3988
1⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ruygcg.dll

Path C:\Windows\SysWOW64\ruygcg.dll
Size 50KB
SHA256 3f104926c32744f368e225401ebaa15eae1c5791d85d824c24a1c5a087c3ab31
MD5 7bd37c3a9423025b3200315714f22b5e
SHA1 18893df26e5762a370212627619a72d82c6b3607
SHA512 1f44e6196b4156ab956ed4594e936a0fb0394b3829c207fc4bc8e5e5b055188ee29e8a8496952c739717061c6746dde37c10194338ecb14f79ddf085c07719b2
SSDEEP 768:Cczzm2poIS9++BtmVOtEEUlSjfN7uF6uUeVBx5gH6S1xyhaBXqslZKbxl/FUZ+4D:R++JVpyjfNSFUB6SiQh0r/Glq/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3988-15-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4240-0-0x0000000000400000-0x000000000040D261-memory.dmp

Download

memory/4240-2-0x0000000000400000-0x000000000040D261-memory.dmp

Download

memory/4240-3-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/4240-4-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4240-7-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/4240-12-0x0000000000400000-0x000000000040D261-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads