dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe
Size 1.4MB
Sample240314-da345sgh2v
SHA256 dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78
MD5 0ec7425d2a0ff149d89db3e0347debe3
SHA1 80d229945b6267b85528e1d2c29615c66a5e04fa
SHA512 4dfa00e8690ab894c5b806810296399032ad5e65f764632fc2ad4aeda72c5d91140701117084e80fc4c95d13fcde79d8c09e71b770c751ab71e89def9cebd76f
SSDEEP 24576:3NBIc0OQms+rYW6eRrRBKkuKgt10f+3ggrTmCmclq14:AViYW6+1ck/gte+QMmCmclqO
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

aspackv2

Malware Config

Signatures

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000002321e-35.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3236-37-0x0000000000A90000-0x0000000000A99000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3236-57-0x0000000000A90000-0x0000000000A99000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000700000002321e-35.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	xJX.exe

Executes dropped EXE 2 IoCs

pid	Process
1828	Autopatch.exe
3236	xJX.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	xJX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	xJX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	xJX.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	xJX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	xJX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	xJX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	xJX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	xJX.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	xJX.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	xJX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	xJX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	xJX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	xJX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	xJX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	xJX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1828	Autopatch.exe
1828	Autopatch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1828	1020	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe	88
PID 1020 wrote to memory of 1828	1020	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe	88
PID 1020 wrote to memory of 1828	1020	dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe	88
PID 1828 wrote to memory of 3236	1828	Autopatch.exe	90
PID 1828 wrote to memory of 3236	1828	Autopatch.exe	90
PID 1828 wrote to memory of 3236	1828	Autopatch.exe	90
PID 3236 wrote to memory of 3676	3236	xJX.exe	103
PID 3236 wrote to memory of 3676	3236	xJX.exe	103
PID 3236 wrote to memory of 3676	3236	xJX.exe	103

C:\Users\Admin\AppData\Local\Temp\dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe
"C:\Users\Admin\AppData\Local\Temp\dbddbf3b43a5d9cbfc20359ef87a295045a2ba9306ed0c62c018073e91f60d78.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\Autopatch.exe
  "C:\Users\Admin\AppData\Local\Temp\Autopatch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\AppData\Local\Temp\xJX.exe
    C:\Users\Admin\AppData\Local\Temp\xJX.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3abb26a6.bat" "
      4⤵
      PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\k2[1].rar
Size 4B
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
MD5 SHA1 SHA512

Submit Download

3abb26a6.bat

Path C:\Users\Admin\AppData\Local\Temp\3abb26a6.bat
Size 181B
SHA256 d4035ea39a1642882b4d0cba16be1e11e8ab4d46c3f69fd99f67907fc5300396
MD5 84c00248ec2d9fbd5011ffd9ed9cb656
SHA1 d697b34ebec6812a2facf49d13a004a12a3cb6b9
SHA512 5864bfc0f722ee4f75ac6213dba7eb161e88ef3bba8e65dd7950de9d89c9c60088ed8bfa4bfe5984e7d0d131271a9790f54871d85c04b189916a381844497c9f
MD5 SHA1 SHA512

Submit Download

64C55166.exe

Path C:\Users\Admin\AppData\Local\Temp\64C55166.exe
Size 4B
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
MD5 SHA1 SHA512

Submit Download

AutoPatch.exe

Path C:\Users\Admin\AppData\Local\Temp\AutoPatch.exe
Size 300KB
SHA256 593f678aa71743d0d916efa39de9a15ab433089cad3dd117dfb32d455fba3d6d
MD5 408e41d45388acb3738c3835eaf22c4c
SHA1 3690d22dd9b81421597edc15deb49a31526d068f
SHA512 5e8bfd82e7bde251be33a2f47fe91eb6ee612b64712f8477c3ae094df669229aef9bc5b512aeda5e70e7d42bb3bf383253dbb5eadb20c489d6aa63b3bbe1b887
SSDEEP 3072:cL5Q2gC9fVNFTj7UIzLAGhXrOU3nGXCfELaln7WY7EfsRWYkyTRdrg8UTr5oVBt/:cL5dRbFvI0hXrzyLMnCwDTRJ+Hwg8w5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SocketConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\AutoPatch\SocketConfig.ini
Size 305B
SHA256 64c55e6463bbc2749fb3a90dae13cde53bbee051986abfd2a24952ab5438887b
MD5 01e1951ce818d30a9adddf5e45f03cfd
SHA1 cabde24499cacedb8ff7550594a33af27c6f6b58
SHA512 c07795604e759c6c09442fd0a6725d4764604a2559bea57b79094d004cd871024a89581bb3cca182c2297e6aebcd987e5ba2aeb20dcd234a207c3f480684e47c
MD5 SHA1 SHA512

Submit Download

Update.log

Path C:\Users\Admin\AppData\Local\Temp\AutoPatch\Update.log
Size 2KB
SHA256 57613ccec51a5d1305848054940fc50a3edba857cf681f0fb09eab143c8958bb
MD5 cd61ca85044ea843240a2884bcf22b93
SHA1 b83b474116e72a725663680aa504afa6c6eee7d1
SHA512 c0d52d1c861c7f0d2cfd0f5e0b6eea9ede9893d92186a470f5164d6bc4d788f90272c2ebe5146c9a478516e796908dba632d6cd161d6c8d75fc8138aab9204fc
MD5 SHA1 SHA512

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\AutoPatch\config.ini
Size 1KB
SHA256 8440e1ec82043b66430a5b7aade340ff7570aef3ee6d8b2c05394d824dc79903
MD5 325a3fe9191c18e85653de016928f26a
SHA1 8db59795dfa79d07baf89289c72ee777d799ee26
SHA512 bedf4af818cb70c8349be13167d02b1d3120bb9796bb96b2a757484dd5c9dc6e82352543761c7010b3a941a85e77ed8dd8a2a7ab8e36da55f728c1d980ea6594
MD5 SHA1 SHA512

Submit Download

version.dat

Path C:\Users\Admin\AppData\Local\Temp\version.dat
Size 4B
SHA256 b281bc2c616cb3c3a097215fdc9397ae87e6e06b156cc34e656be7a1a9ce8839
MD5 fba9d88164f3e2d9109ee770223212a0
SHA1 a5b1d7e217aa227d5b2b8a84920780cf637960e2
SHA512 59963bfd1fef9ea453959517c8755d00cfa0d7c57f112404f3ca9def63986c149d9aabb28ccb225b5a3470e42a170141558d6d6b87ff104931c754fad0d5c933
MD5 SHA1 SHA512

Submit Download

xJX.exe

Path C:\Users\Admin\AppData\Local\Temp\xJX.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1828-49-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/1828-32-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/3236-37-0x0000000000A90000-0x0000000000A99000-memory.dmp

Download

memory/3236-57-0x0000000000A90000-0x0000000000A99000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads