9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Size 214KB
Sample240404-21dh6sch2x
SHA256 9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7
MD5 28903409be4a183fc4970238d695e76d
SHA1 b354d82e073c5e296881301337047ed7a899a7d9
SHA512 5364364c68c41ab1c27c3da18bcb89f51d6210df7301c1c6f9ab8e56ca96bfdf09d1a0847780a34b6571e0d4c0973a1284b6d6d3064824557e2e416749604867
SSDEEP 3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c:dOizzb8uDxZCHlIZgEh5DyXglh
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

aspackv2 persistence

Malware Config

Signatures

Detects executables packed with ASPack 16 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016c04-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0009000000015df1-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2368-26-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-28-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-29-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-31-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-32-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-33-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-34-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-35-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-36-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-37-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-38-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-40-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-41-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2396-42-0x0000000000400000-0x000000000046E000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000016c04-9.dat	aspack_v212_v242
behavioral1/files/0x0009000000015df1-19.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2396	KAP.EXE

Loads dropped DLL 2 IoCs

pid	Process
2368	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
2368	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\IFHOLJP.EXE \"%1\" %*"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	KAP.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IFHOLJP.EXE = "C:\\Windows\\IFHOLJP.EXE"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\R:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\L:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\S:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\T:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\E:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\H:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\I:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\O:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\Q:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\U:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\G:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\K:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\M:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\J:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\P:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened (read-only)	\??\V:	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\IFHOLJP.EXE	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
File opened for modification	C:\Windows\IFHOLJP.EXE	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\IFHOLJP.EXE %1"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\IFHOLJP.EXE \"%1\""	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	KAP.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Windows\\IFHOLJP.EXE %1"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Windows\\IFHOLJP.EXE \"%1\""	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\IFHOLJP.EXE \"%1\" %*"	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2396	KAP.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2396	2368	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe	28
PID 2368 wrote to memory of 2396	2368	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe	28
PID 2368 wrote to memory of 2396	2368	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe	28
PID 2368 wrote to memory of 2396	2368	9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe	28

C:\Users\Admin\AppData\Local\Temp\9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe
"C:\Users\Admin\AppData\Local\Temp\9372bdfef3dbd88cf9caad2bf36307eebc9f7633c1c75dd0fe514aae45cb64d7.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368
- C:\PerfLogs\KAP.EXE
  C:\PerfLogs\KAP.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IFHOLJP.EXE

Path C:\Windows\IFHOLJP.EXE
Size 215KB
SHA256 9e8b2878f8fd057ea3706c874166904df49cba19aed872c5a4553872ccac8396
MD5 5a565a962f4302d8041af3cd2f6dab1c
SHA1 f747f78e81d69c39a25122bd593bccd90c6b8280
SHA512 2aeebbfd9a295c187644e41bb4dd41b0355919fd4f23129449f0c47f218f5b597486f41918a2c6102be3b8384b6890f34f77cdfc32ed796d869e1d2f33d2fd57
SSDEEP 3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c:dOizzb8uDxZCHlIZgEh5DyXglh
MD5 SHA1 SHA512 SSDEEP

Submit Download

KAP.EXE

Path \PerfLogs\KAP.EXE
Size 214KB
SHA256 3553aac2273527114a6104a918f69284e1488ad3d075ed3d4c958fc1d991fe76
MD5 f7573aed5987b1c228eb787fb3a7a70b
SHA1 bf4cd55e04b8c2fccb5fdf5af0acdef5a1791b7f
SHA512 868dde9d2ee6422a29e33059a1ceebd03b118c6f3a8a3187744177e6409210404f760f6deb599fd58ef8fb5848dde66247a3cca22a871ae990e458b882fe8148
SSDEEP 3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c:dOizzb8uDxZCHlIZgEh5DyXglh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2368-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Download

memory/2368-26-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-31-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-29-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-30-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2396-27-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2396-32-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-28-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-35-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-36-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-37-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-38-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-40-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-41-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2396-42-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads