Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 11:53

General

  • Target

    ASPack.exe

  • Size

    373KB

  • MD5

    a8e5ccfab37f759f2914335d21181b9f

  • SHA1

    e64244de48c410cf3b8452597d75c557cd4434bd

  • SHA256

    1df4d6648753095803f0fdffaffc39edfc908ffa66d4dca33a1b1d689175a3f0

  • SHA512

    329a6d2cb4385a0a53b808f072eaaad81630ecf851f9cc3a6746a2438c853dade6b97eb6701eee7ae909f952f8f331af5bb8b53b2059b289173549efcf0cc91e

  • SSDEEP

    6144:HqljTfN8OTNv+jotlGPbymiP8JPAvgWZpg3SyBwOJFfDn+aC0sytWnPV7srfh1QH:Hql3iiNCotlGDydP8JFWHXyG4FzW0XIF

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 60 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ASPack.exe
    "C:\Users\Admin\AppData\Local\Temp\ASPack.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1372

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1372-0-0x0000000000400000-0x00000000004BD000-memory.dmp

          Filesize

          756KB

        • memory/1372-1-0x00000000762F1000-0x00000000762F2000-memory.dmp

          Filesize

          4KB

        • memory/1372-3-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-4-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-10-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-12-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-15-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-14-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-13-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-23-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-26-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-28-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-30-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-32-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-49-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-51-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-50-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-21-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-56-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-55-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-59-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-58-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-57-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-54-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-53-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-52-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-20-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-19-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-18-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-17-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-16-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-48-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-47-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-46-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-60-0x00000000048B0000-0x00000000048B2000-memory.dmp

          Filesize

          8KB

        • memory/1372-45-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-44-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-43-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-42-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-41-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-40-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-39-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-38-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-37-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-36-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-35-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-34-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-33-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-31-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-29-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-27-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-25-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-24-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-22-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-11-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-9-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-8-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-7-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-6-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-5-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-2-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-61-0x0000000000400000-0x00000000004BD000-memory.dmp

          Filesize

          756KB

        • memory/1372-64-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-63-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-62-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-65-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB

        • memory/1372-66-0x00000000762E0000-0x00000000763F0000-memory.dmp

          Filesize

          1.1MB