d0065a3bd5a1c4a0b855ff2de2ad8c3ddfe4de301744ca002c736a992bb86630

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c910487fa6c5f2904490e5847b987c8b.exe
Size 97KB
Sample240314-ts6wraag79
SHA256 d0065a3bd5a1c4a0b855ff2de2ad8c3ddfe4de301744ca002c736a992bb86630
MD5 c910487fa6c5f2904490e5847b987c8b
SHA1 9dd7708e2b246dff905fdc8d9eea0843c11f64c8
SHA512 75c4ccda3e1331aa821904cf4896b84a6e922713c8fb70c6b123221d003094b233d292f457804b9de8b128071e68d585a7fa7349aea7af7ec6258fc5535a1dbd
SSDEEP 1536:0AdKYyagoAUq4Ux2EdYmotbg2Ud3cBsOdRqK5:0cCa8UU/dYmo1g2BBki
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\windowsÏµÍ³¸üÐÂÒÑ°²×°\parameters\ServiceDll = "%SYSTEMROOT%\\SYSTEM32\\rrzhfc.dll"	c910487fa6c5f2904490e5847b987c8b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\windowsÏµÍ³¸üÐÂÒÑ°²×°\parameters\ServiceDll = "%SYSTEMROOT%\\SYSTEM32\\rrzhfc.dll"	c910487fa6c5f2904490e5847b987c8b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\windowsÏµÍ³¸üÐÂÒÑ°²×°\parameters\ServiceDll = "%SYSTEMROOT%\\SYSTEM32\\rrzhfc.dll"	c910487fa6c5f2904490e5847b987c8b.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000023212-3.dat	aspack_v212_v242

Loads dropped DLL 4 IoCs

pid	Process
4324	c910487fa6c5f2904490e5847b987c8b.exe
2544	SVCHOST.exe
2544	SVCHOST.exe
2544	SVCHOST.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0004c5ec.ini	c910487fa6c5f2904490e5847b987c8b.exe
File created	C:\Windows\SysWOW64\rrzhfc.dll	c910487fa6c5f2904490e5847b987c8b.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3060	2544	WerFault.exe	89
3300	2544	WerFault.exe	89
4228	2544	WerFault.exe	89

C:\Users\Admin\AppData\Local\Temp\c910487fa6c5f2904490e5847b987c8b.exe
"C:\Users\Admin\AppData\Local\Temp\c910487fa6c5f2904490e5847b987c8b.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:4324

C:\Windows\SysWOW64\SVCHOST.exe
C:\Windows\SysWOW64\SVCHOST.exe -kwindowsÏµÍ³¸üÐÂÒÑ°²×°
1⤵
- Loads dropped DLL
PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 536
  2⤵
  - Program crash
  PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 572
  2⤵
  - Program crash
  PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 576
  2⤵
  - Program crash
  PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2544 -ip 2544
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2544 -ip 2544
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2544 -ip 2544
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rrzhfc.dll

Path C:\Windows\SysWOW64\rrzhfc.dll
Size 59KB
SHA256 03cd47507f2470e02dff6d39a6c392d5e9c958127923b994aa54be422cdefa84
MD5 bcb834da4b1b67cc875876ed0ba5b79a
SHA1 b02298dad8d17f3a48bb0894ad71aa4c905a0526
SHA512 87a47dd4af4725f5d7afbb89c44dcb7d84e6d5fa98dc6b85eabc4c0013b502dd96fd559c04fbb6a7db3fbfb000571ae4d2afb932a201bb6d8f6bc31f0e1d09ea
SSDEEP 1536:/wuwmtO6hdtsvkS0Nc835n6oZhXH6HA8bwUe2bwUeR:XtdtssS0NNNhT3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4324-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4324-8-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads