85af7d54716d98e4e63610f7b9f3015a269771bd5ee7b7f2b65e0f69ae678094

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe
Size 116KB
Sample240315-lq3gjsdc4x
SHA256 85af7d54716d98e4e63610f7b9f3015a269771bd5ee7b7f2b65e0f69ae678094
MD5 cb16c3fbe2d987f0f2c0a8dd31c06b9a
SHA1 7a16eb502bd05d55174db83636f0cf8f0dc1e714
SHA512 efc365f2c8d93bdcfbeecc5a7444e7e3269f23a3391d1ae00e791b7c42f61f19ad6b9ba331f1f782d1358f12ba62180d50bc6e788d85660cfc42e051271c11d9
SSDEEP 3072:YR1+aJe1mgawzxsBub861jIHxowwnyypmMGdSu51eUK7:YRUTV5nbmMWFQH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c0000000226fd-4.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe

Executes dropped EXE 1 IoCs

pid	Process
492	PLISB.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1020	492	WerFault.exe	89
4856	492	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 492	1508	cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe	89
PID 1508 wrote to memory of 492	1508	cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe	89
PID 1508 wrote to memory of 492	1508	cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe	89

C:\Users\Admin\AppData\Local\Temp\cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe
"C:\Users\Admin\AppData\Local\Temp\cb16c3fbe2d987f0f2c0a8dd31c06b9a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1508
- C:\PLISB.EXE
  "C:\PLISB.EXE"
  2⤵
  - Executes dropped EXE
  PID:492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 252
    3⤵
    - Program crash
    PID:1020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 264
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 492 -ip 492
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 492 -ip 492
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PLISB.EXE

Path C:\PLISB.EXE
Size 73KB
SHA256 b273425e547c3cf25cd8de6924d13cba9c1ec0e37b9009ca6535f083bb17d531
MD5 94b1056d8ca4b139849997a9b4f2020a
SHA1 6c5c9f5fcdd99573cf5380fa39e2ff4fab1fa493
SHA512 241d10598d1e57d74a02333509423ebbc53f082df09eaeadecabda5da2a4a6874fce2c8b4a2cbfd40ac84b053c2ecfdacc7c163c25ecb9ffd4e9e2f5e780b13a
SSDEEP 1536:kCxKOBJyypgmDzV2NSQ85GdSu62Cnts1LxgUKB:/nyypmMGdSu51eUKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/492-8-0x0000000010000000-0x0000000010013200-memory.dmp

Download

memory/492-10-0x0000000010000000-0x0000000010013200-memory.dmp

Download

memory/1508-9-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads