8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
Size

39KB
MD5

a7409de56e31f3b78beca5183a7caa76
SHA1

bcb74b5c2d609a36bdc9d913f0eff046d88afabd
SHA256

8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3
SHA512

7308ba2a3a3d868e3af88a4eac636037995cf03596bcc6d8b871e2148ffa48434b101c77eaab23c4c77cffe56fa5bf1655c6f6eeca8fe0f463ca497e4a1e4f19
SSDEEP

768:41cccMCk5JBIJTaFBNsZzOFXBAWfGcxbLfbG8vsb7yV4SPYmNRU9bVzjbc:41ccd5JKJW/sZ8xAWf5Kan2SPYxbVzjg

Score

9^/10

aspackv2

Malware Config

Signatures

Detects executables packed with ASPack 4 IoCs

resource	yara_rule
behavioral1/memory/1660-0-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1660-1-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000014eb9-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1660-20-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000014eb9-6.dat	aspack_v212_v242

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\Doom 3 + cdfix.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\Quake3(patch).exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\Silent Hill 4 + nocd.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\Sims 2_cdfix.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\Sims 2(patch).exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\Sims 2 patch.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\Sims 2 patch.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\DAoC_codes.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\DAoC_codes.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\Quake3_codes.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\UT2004 patch.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\UT2004 patch.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\BattleField 1942_patch.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942_patch.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File created	C:\Windows\win32dc\Sims 2_cdfix.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\Sims 2(patch).exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + nocd.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
File opened for modification	C:\Windows\win32dc\Quake3_codes.exe	8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe

C:\Users\Admin\AppData\Local\Temp\8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe
"C:\Users\Admin\AppData\Local\Temp\8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3.exe"
1⤵
- Drops file in Windows directory
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Doom 3 + cdfix.exe

Filesize
39KB

MD5
a7409de56e31f3b78beca5183a7caa76

SHA1
bcb74b5c2d609a36bdc9d913f0eff046d88afabd

SHA256
8b1c0498289e674cda3cd0278ebd76f12017f6159505436f6039afe1476609a3

SHA512
7308ba2a3a3d868e3af88a4eac636037995cf03596bcc6d8b871e2148ffa48434b101c77eaab23c4c77cffe56fa5bf1655c6f6eeca8fe0f463ca497e4a1e4f19

Download Submit
memory/1660-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1660-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1660-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads