41a3c56b23a6293acfbc2668bf16241d8f57046c982389e9dbc60dfa35c641d6

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d752813ced6cb1bbd3a3df6237291519.exe
Size 152KB
Sample240319-29fd5aah41
SHA256 41a3c56b23a6293acfbc2668bf16241d8f57046c982389e9dbc60dfa35c641d6
MD5 d752813ced6cb1bbd3a3df6237291519
SHA1 1873d3471d6d0d04d4c09ffb14ca7b91b4be2b93
SHA512 bfb1e2291e5eb31f0124469e6b64150c80f5c4fd6cf239ca5c6ebd601ab20e12a595c453c68fefcb39abcaa567d11d2601aa429b416def63d8af5cb86b9fab03
SSDEEP 3072:8Q4rPdsSyHbol/Qqp014yLKING+SgF9yC0rncOj0zon2tYX3NKkAz:8Q4rPdPOoma0BKIIaECicOconTX3If
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	47db0f0b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	47db0f0b.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000002271f-5.dat	aspack_v212_v242
behavioral2/files/0x000400000002271f-3.dat	aspack_v212_v242
behavioral2/files/0x0008000000023258-13.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3500	47db0f0b.exe

Loads dropped DLL 1 IoCs

pid	Process
1532	WerFault.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000400000002271f-5.dat	upx
behavioral2/memory/3500-4-0x0000000000720000-0x0000000000744000-memory.dmp	upx
behavioral2/files/0x000400000002271f-3.dat	upx
behavioral2/memory/3500-7-0x0000000000720000-0x0000000000744000-memory.dmp	upx
behavioral2/memory/3500-6-0x0000000000720000-0x0000000000744000-memory.dmp	upx
behavioral2/files/0x0008000000023258-13.dat	upx
behavioral2/memory/3500-26-0x0000000000720000-0x0000000000744000-memory.dmp	upx

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\2BE90C5C.tmp	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	47db0f0b.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	47db0f0b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	3328	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3500	47db0f0b.exe
3500	47db0f0b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3500	3328	d752813ced6cb1bbd3a3df6237291519.exe	97
PID 3328 wrote to memory of 3500	3328	d752813ced6cb1bbd3a3df6237291519.exe	97
PID 3328 wrote to memory of 3500	3328	d752813ced6cb1bbd3a3df6237291519.exe	97

C:\Users\Admin\AppData\Local\Temp\d752813ced6cb1bbd3a3df6237291519.exe
"C:\Users\Admin\AppData\Local\Temp\d752813ced6cb1bbd3a3df6237291519.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\47db0f0b.exe
  C:\47db0f0b.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 236
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3328 -ip 3328
1⤵
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47db0f0b.exe

Path C:\47db0f0b.exe
Size 49KB
SHA256 50063a42504f3a9c5a3eeab62283c88b4629990ec8750744f366d2e3d6fd8277
MD5 645c3568c57df62422a548cc0fadb2f5
SHA1 7f5b91db5a713cdbf3c3d7aba627d2cd1f8eef73
SHA512 b33d95242803b20415019393a86f00091b3a8359a2f0e2c1f5ab4815cea43a1e7fd06db64591bf89272792fb4c98d90c355e365e4bc67f0efb7d45399079079f
SSDEEP 768:uglKXIDBdrejbEH6g1gO+koGCNG4ay/J/d2SmryOLkq50WlkjnzKzvCAYQ9R:uglf9dObCmzrnNG4rljmrMq5ujz2tYYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

47db0f0b.exe

Path C:\47db0f0b.exe
Size 38KB
SHA256 71ee8fd020dfd65c5701fd43029ce597666c713edb0f8e435f6550bdb4fb00a7
MD5 f490c1a08dd91483e49fa1af05f41a7b
SHA1 39f6a2985d95d32f545b7357f3c6273e8bd30f76
SHA512 549dbd99437ce99a122f2371eeb1eae38861e5a0cf55d0c221d7857aecff04eb706fc3ea81b312d0f582e6cc7ac7c5b98ba4805e1f292fed0a9992f501fdf8de
SSDEEP 768:uglKXIDBdrejbEH6g1gO+koGCNG4ay/J/d2SmryOLkq50WlkE:uglf9dObCmzrnNG4rljmrMq5uE
MD5 SHA1 SHA512 SSDEEP

Submit Download

2BE90C5C.tmp

Path C:\Windows\SysWOW64\2BE90C5C.tmp
Size 82KB
SHA256 639d628edbf3d0efd32dfa189bf961d9eff3492f0b26ec639e45523141620a02
MD5 a777e706400b0f7fd1ae63a9a579c6b1
SHA1 26b328d60a0135df7ccddfaf2c342b7e48c18932
SHA512 ee889f84a43db25b1329e2cb370e57305df776a5dc5f31f8dc4b610e24fd6327c9e43f65944b7b9d420e9936911c7ada2507e8b2924f3e7b4c2a5f4f69e180e7
SSDEEP 1536:Oglf9dObCmzrnNG4rljmrMq5ujz2tYYPIH36QRfKi/AcW/iU:OgF9yC0rncOj0zon2tYX3NKkAz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3328-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3328-28-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3500-4-0x0000000000720000-0x0000000000744000-memory.dmp

Download

memory/3500-7-0x0000000000720000-0x0000000000744000-memory.dmp

Download

memory/3500-6-0x0000000000720000-0x0000000000744000-memory.dmp

Download

memory/3500-10-0x0000000076FC2000-0x0000000076FC3000-memory.dmp

Download

memory/3500-11-0x0000000074ED0000-0x0000000074EF5000-memory.dmp

Download

memory/3500-26-0x0000000000720000-0x0000000000744000-memory.dmp

Download

memory/3500-27-0x0000000074ED0000-0x0000000074EF5000-memory.dmp

Download