Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 02:38

General

  • Target

    f4414fd38f14c87111b43de3eee773ac1e623f4e3e90edbf1105bc56e0d21828.exe

  • Size

    205KB

  • MD5

    69aac64c391c32e8c806478a5df765e0

  • SHA1

    8454551ea6f96239a486d935440f4967016be5a8

  • SHA256

    f4414fd38f14c87111b43de3eee773ac1e623f4e3e90edbf1105bc56e0d21828

  • SHA512

    6a2ac775f64d881db987e4e19d04c677b6879ed6fa1b02829b5d49a8d71899a10346f72d49cd00304bac5cd1492cf2a7cc85e4305408ed53320c3aa477dccaa8

  • SSDEEP

    6144:MSDDT7cqUTwsXn5ZPxyQZudimLbVC7jsfuTTDI1:9wqEX5ZPxyQZu90nsfCT

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 3 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4414fd38f14c87111b43de3eee773ac1e623f4e3e90edbf1105bc56e0d21828.exe
    "C:\Users\Admin\AppData\Local\Temp\f4414fd38f14c87111b43de3eee773ac1e623f4e3e90edbf1105bc56e0d21828.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\HMFmfziR.exe
      C:\Users\Admin\AppData\Local\Temp\HMFmfziR.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\138a4376.bat" "
        3⤵
          PID:2816

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\k2[1].rar

            Filesize

            4B

            MD5

            d3b07384d113edec49eaa6238ad5ff00

            SHA1

            f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

            SHA256

            b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

            SHA512

            0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

          • C:\Users\Admin\AppData\Local\Temp\138a4376.bat

            Filesize

            191B

            MD5

            ddfa5e10ee9ceaaf6e963eb13b1077e7

            SHA1

            8c7634d6f3a63a1d5c97475cdf0a3442dac48207

            SHA256

            ab0fb38ec1b464e4f44c859c8ab31018e01130f6905eb528d397b4e579d77695

            SHA512

            0056ee72e6adf8c8012019ce65ac136da0bbfb0f68a62db7b4e15895ac8af1b76058958a6283fcb8683623bb79db50647f8221d7d6570bf611f31614738d95ef

          • C:\Users\Admin\AppData\Local\Temp\64C57CB2.exe

            Filesize

            4B

            MD5

            20879c987e2f9a916e578386d499f629

            SHA1

            c7b33ddcc42361fdb847036fc07e880b81935d5d

            SHA256

            9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

            SHA512

            bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

          • C:\Users\Admin\AppData\Local\Temp\HMFmfziR.exe

            Filesize

            15KB

            MD5

            56b2c3810dba2e939a8bb9fa36d3cf96

            SHA1

            99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

            SHA256

            4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

            SHA512

            27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

          • memory/2848-11-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

            Filesize

            36KB

          • memory/2848-10-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

            Filesize

            36KB

          • memory/2848-0-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/2848-55-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/2880-12-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

            Filesize

            36KB

          • memory/2880-53-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

            Filesize

            36KB