bdb98e74e9444ae9d6048f6c7a8feb5f09c1a804e7765b049d4fa70307c0f811

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d49fb3a7c250761a5b91a5cfe5088f4c.exe
Size

83KB
MD5

d49fb3a7c250761a5b91a5cfe5088f4c
SHA1

acae9ae24b823fdea2ee62bd7f4d82501a77e58b
SHA256

bdb98e74e9444ae9d6048f6c7a8feb5f09c1a804e7765b049d4fa70307c0f811
SHA512

9bdf85cfdafa0d6d656b8fc655133495bc2a087b5884c7d971273aba15206025fc034d9b1276a7301351e1d36b280532affc2bd9f22a335d1658f71d77e207a0
SSDEEP

1536:Er9uDi4Yrfqik9xuCr5IuCArQ+OqpLEytSSejie5Kcn:7erfqpuClIuxrU+Eyt1emU

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000002323f-10.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
4668	d49fb3a7c250761a5b91a5cfe5088f4c.sys
3684	kjk.exe
3548	kjk.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\kjk = "C:\\Windows\\kjk.exe"	d49fb3a7c250761a5b91a5cfe5088f4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjk = "C:\\Windows\\kjk.exe"	d49fb3a7c250761a5b91a5cfe5088f4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\kjk = "C:\\Windows\\kjk.exe"	kjk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjk = "C:\\Windows\\kjk.exe"	kjk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\kjk.exe	d49fb3a7c250761a5b91a5cfe5088f4c.exe
File created	C:\Windows\kjk.sys	kjk.exe
File opened for modification	C:\Windows\kjk.sys	kjk.exe
File created	C:\Windows\kjk.exe	kjk.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2	kjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1"	kjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0"	kjk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe
2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe
3684	kjk.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4668	2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe	97
PID 2620 wrote to memory of 4668	2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe	97
PID 2620 wrote to memory of 4668	2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe	97
PID 2620 wrote to memory of 3684	2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe	98
PID 2620 wrote to memory of 3684	2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe	98
PID 2620 wrote to memory of 3684	2620	d49fb3a7c250761a5b91a5cfe5088f4c.exe	98
PID 3684 wrote to memory of 3548	3684	kjk.exe	100
PID 3684 wrote to memory of 3548	3684	kjk.exe	100
PID 3684 wrote to memory of 3548	3684	kjk.exe	100

C:\Users\Admin\AppData\Local\Temp\d49fb3a7c250761a5b91a5cfe5088f4c.exe
"C:\Users\Admin\AppData\Local\Temp\d49fb3a7c250761a5b91a5cfe5088f4c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\d49fb3a7c250761a5b91a5cfe5088f4c.sys
  C:\Users\Admin\AppData\Local\Temp\d49fb3a7c250761a5b91a5cfe5088f4c.sys /zhj
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\kjk.exe
  C:\Windows\kjk.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\kjk.sys
    C:\Windows\kjk.sys /zhj
    3⤵
    - Executes dropped EXE
    PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d49fb3a7c250761a5b91a5cfe5088f4c.sys

Filesize
60KB

MD5
732e3d252f7805b9b75246d8b6879c21

SHA1
fdaea0a522d35714c5e802ef20c555bb9c66cfcd

SHA256
6eedcc6cfb370c47f7a06983e98aa29fbfd3a914d34545f9af1c76acf6ff4c94

SHA512
3c80e053af88fe1933218c76a0223a2c6ed45e977e19ac9b934700a4b657bd6c3f58954f564e56509a4ae1f6af3409ef4c9828352e649316e60f4b7704c769b1

Download Submit
C:\Windows\kjk.exe

Filesize
83KB

MD5
d49fb3a7c250761a5b91a5cfe5088f4c

SHA1
acae9ae24b823fdea2ee62bd7f4d82501a77e58b

SHA256
bdb98e74e9444ae9d6048f6c7a8feb5f09c1a804e7765b049d4fa70307c0f811

SHA512
9bdf85cfdafa0d6d656b8fc655133495bc2a087b5884c7d971273aba15206025fc034d9b1276a7301351e1d36b280532affc2bd9f22a335d1658f71d77e207a0

Download Submit
memory/2620-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-19-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-26-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-27-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-28-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-29-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-30-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-31-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3684-32-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download