6b63720567cacc9baf3682383f02f63777d50764b5fe6a906021b9c108118de4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7c40b34eb586dce7ac1c927211ce652.exe
Size 81KB
Sample240306-s45bmacd9w
SHA256 6b63720567cacc9baf3682383f02f63777d50764b5fe6a906021b9c108118de4
MD5 b7c40b34eb586dce7ac1c927211ce652
SHA1 4739ecc8d38bb6e6c2f3971d2185ece983f91ba4
SHA512 7ba2958c66e6b9e9cb28c9874948d774744b6219bf60a880f37db7f9e34f74757fbc5f3a4520be0b93f6cf6523efb384ab5eebf6fab1ceb098e2454c0fa33f98
SSDEEP 1536:gLXB65939tY6HBg4sXJZx/SRbTvwCLtXSisRTec0wH5vu96:gLk395hYXJZpGICLtX0RSc0k5vus
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2 persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023231-18.dat	acprotect

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000002322e-27.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	b7c40b34eb586dce7ac1c927211ce652.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	02.exe

Executes dropped EXE 2 IoCs

pid	Process
4180	02.exe
4996	d2.exe

Loads dropped DLL 2 IoCs

pid	Process
2544	rundll32.exe
2544	rundll32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001e5eb-5.dat	upx
behavioral2/files/0x0008000000023231-18.dat	upx
behavioral2/memory/4180-11-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4180-35-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2544-39-0x0000000010000000-0x0000000010016000-memory.dmp	upx

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rundll32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sfcos.dll	02.exe
File opened for modification	C:\Windows\SysWOW64\sfcos.dll	02.exe
File created	C:\Windows\SysWOW64\dbgtemp	02.exe
File created	C:\Windows\SysWOW64\dsoundtemp	02.exe
File opened for modification	C:\Windows\SysWOW64\50DF.tmp	02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4180	2764	b7c40b34eb586dce7ac1c927211ce652.exe	88
PID 2764 wrote to memory of 4180	2764	b7c40b34eb586dce7ac1c927211ce652.exe	88
PID 2764 wrote to memory of 4180	2764	b7c40b34eb586dce7ac1c927211ce652.exe	88
PID 2764 wrote to memory of 4996	2764	b7c40b34eb586dce7ac1c927211ce652.exe	89
PID 2764 wrote to memory of 4996	2764	b7c40b34eb586dce7ac1c927211ce652.exe	89
PID 2764 wrote to memory of 4996	2764	b7c40b34eb586dce7ac1c927211ce652.exe	89
PID 4180 wrote to memory of 3108	4180	02.exe	90
PID 4180 wrote to memory of 3108	4180	02.exe	90
PID 4180 wrote to memory of 3108	4180	02.exe	90
PID 4180 wrote to memory of 412	4180	02.exe	92
PID 4180 wrote to memory of 412	4180	02.exe	92
PID 4180 wrote to memory of 412	4180	02.exe	92
PID 412 wrote to memory of 2544	412	cmd.exe	94
PID 412 wrote to memory of 2544	412	cmd.exe	94
PID 412 wrote to memory of 2544	412	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\b7c40b34eb586dce7ac1c927211ce652.exe
"C:\Users\Admin\AppData\Local\Temp\b7c40b34eb586dce7ac1c927211ce652.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\02.exe
  "C:\Users\Admin\AppData\Local\Temp\02.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\sfc.exe
    "C:\Windows\system32\sfc.exe" /REVERT
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\del.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\system32\s2am.ime,Runed
      4⤵
      Loads dropped DLL
      Modifies WinLogon
      PID:2544
- C:\Users\Admin\AppData\Local\Temp\d2.exe
  "C:\Users\Admin\AppData\Local\Temp\d2.exe"
  2⤵
  - Executes dropped EXE
  PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02.exe

Path C:\Users\Admin\AppData\Local\Temp\02.exe
Size 40KB
SHA256 1c6f34b1348c2d81d3588dd2fa316b2e5fd161a8c019d2aeac79834556eff4e4
MD5 d96aaafa8912dd8198cc0a66ddaa4d93
SHA1 d1a0114132a0353702f2c508d2822c7714315ffd
SHA512 2197dbd31f1df6ecdc5e0cf1bc94cf188a121c8394b854f94fef2c3cf2e53c01fc1b3aa68daa3aaf31446a854f8b220f520b59c1b0c93823363fb93896b89805
SSDEEP 768:fnxC4FOxnoBKNWOzcqRPLqE4Y9JExiqdRHFFS6ai6uIdG62K:zOKBVUSyE3jH3S6id5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

d2.exe

Path C:\Users\Admin\AppData\Local\Temp\d2.exe
Size 16KB
SHA256 19e4dc504ba46d5e15ccf60f68ab0acb00aa1006c67c7a53266555aa795f5866
MD5 c0ffdb7d43d4111e0292bba5e3ac03c3
SHA1 3c13be5ee0134e7dbf597b0dda65077b165a704b
SHA512 b4e7b934ed59848501bc5be0d19733880e959c36df3d61278c8e48b6ad61d004f0f19df054966dff494cfc71d922390b32591e2304260508f3986faa593af05a
SSDEEP 384:/p+zstIVUtu2ydgW2V4WAeRBnBckN0yJG7+AxNr6+I9PfYUD:/0zstIVh2s2LBBH0yJG7JxgLoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

50DF.tmp

Path C:\Windows\SysWOW64\50DF.tmp
Size 32KB
SHA256 1c854c04e76d0452a434b3953df0f869bbb1004037e08956f56f4fcb7965d4cc
MD5 d02e9909718fc9cafe509a6f1b076e20
SHA1 da36a9acdcf3edda9d8dedfdd82c27c2269d2ec0
SHA512 290c3fa6682be39561f98e47c3067305df5c27f02a24b5c53f6b661dac5ef47a6716cb1720c7b5289dd5489a7e137f7f0b84efb5c13489c666495c886c886446
SSDEEP 768:rn4/4BPCRCow1iRYvTji5drySSxn8k/AIaWAveUos:rFBPCRY1iRnrWnn/AIDFUos
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbgtemp

Path C:\Windows\SysWOW64\dbgtemp
Size 9KB
SHA256 ebaa703c2d70f0dfd10a5b4b309d64f75db3381df83981af430c3b29d0801c70
MD5 c3545163199f7d12a1339489fd877dd4
SHA1 63f0ad4847aa669a0719ef5cce7031fbf80f6615
SHA512 bd8de961d40c23510778204e89722b24f99456c14cc67be2b358aa4d53b962f17eec9c731558c568126aa245e0b28f4e5f6475f85101490fe7e2123f212393d4
SSDEEP 192:eaJraOdwlKhD/NxAGFvF0o8uZisgm8RG78jPzMQYS5iUY1NnRsfazutlXr9:eaQOdwlKt1xAfXr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsoundtemp

Path C:\Windows\SysWOW64\dsoundtemp
Size 4KB
SHA256 98b73d00985aee2cf76451c63aff1f6b3765ea2f0942427f0fe9731ca98e7083
MD5 e74734d35e56385de26d7877ef34395a
SHA1 0fbedc3043990ce43c87607ed6c79686cb352acf
SHA512 7115be3f75156899e390aff78e1be7f5c6765cac3510f3397012c7e0a6dd9157d0900da5348b6b8a056e1d37fb831e0e80854d517d1e4a779f3b75a3ae962afb
SSDEEP 48:ajfrKz+woHlS9dtyUzrkfNoaZHVBfqIh9:eZ0xyUzrkfiqb9
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfcos.dll

Path C:\Windows\SysWOW64\sfcos.dll
Size 48KB
SHA256 d9d8ce1b86b3978889466ab1b9f46778942d276922bf7533327a493083913087
MD5 98c499fccb739ab23b75c0d8b98e0481
SHA1 0ef5c464823550d5f53dd485e91dabc5d5a1ba0a
SHA512 9e64ac13e18ab0a518bb85b6612520645b5ab2c9a5359ced943813ba7344714999f25ba0e52240ad2d0c2fefc76552ff43173adc46334ff0b5dba171fb58e4e6
SSDEEP 768:iAHOev0jjN6n/6J0kQP6t/s8oDSwxgWK9I/WOMPbr6wD1Ped:iAuevh/6J5QP6Vum/9IubbPed
MD5 SHA1 SHA512 SSDEEP

Submit Download

del.bat

Path \??\c:\del.bat
Size 183B
SHA256 d14e4cf7bb2ae1ee37962323e689cde16e4003ffa803a41b45e30fb39a6e4a33
MD5 cf65a019e9dd0be286b64d1b12925b36
SHA1 eeb2c7f27f8f66a66ff65a0dadd337ae1585d807
SHA512 d02160dadc475e927f2edf43ffa736b6b66bbb29a95f460938837d1b43ab2c70099af9938afdf6e7e4b599ac24701b69c216eb93c6e591c1bb6287076d8646fa
MD5 SHA1 SHA512

Submit Download

memory/2544-39-0x0000000010000000-0x0000000010016000-memory.dmp

Download

memory/4180-11-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4180-35-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4996-29-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4996-44-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads