42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
Size

4.3MB
MD5

951f19a10c46fcbe3d0e2e3169628fb0
SHA1

3ea603d5fac272b14aa3bd02f6f6e49e2326c2cc
SHA256

42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06
SHA512

3a1dde9646905f37e6b93494bf3d1f4b2bec2fa2deac009634cac2445ec2e33bdb58f29bbd11120710f1c266b38e630769f4197ab86ef613b91b3eddd6506920
SSDEEP

98304:1i0li0khMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMV:40I0kJ

Score

10^/10

aspackv2 discovery persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b000000012260-2.dat	aspack_v212_v242
behavioral1/files/0x0006000000017553-38.dat	aspack_v212_v242
behavioral1/files/0x0001000000000026-53.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
1348	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
1348	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\P:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\S:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\V:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\W:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\E:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\N:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\Y:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\M:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\R:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\U:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\H:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\I:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\A:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\K:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\Q:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\T:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\G:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\J:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\X:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\O:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\Z:	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened (read-only)	\??\A:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened for modification	C:\AUTORUN.INF	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2712	1348	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe	30
PID 1348 wrote to memory of 2712	1348	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe	30
PID 1348 wrote to memory of 2712	1348	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe	30
PID 1348 wrote to memory of 2712	1348	42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe	30

C:\Users\Admin\AppData\Local\Temp\42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe
"C:\Users\Admin\AppData\Local\Temp\42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06N.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.exe

Filesize
4.3MB

MD5
f870d4de68d696d87894870d9bdcd829

SHA1
f999fdb175c576d8eabfce8ddc63c65f5885c57c

SHA256
226bdcfee880fc097c83287f32e053ea801e8862fb8a03f5b0c4e5270154f190

SHA512
e887effb49b9578a8f5eb3761011d0b13d29b52cef0c1f5ba484737e84875a1a8ee1a9bd8e5c971dcc3064d407f7cba059f7e5cc80d4d7d89dfd9357415a8859

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
950B

MD5
c4c1dfe699f826804f135c0be282569f

SHA1
f3494d814d88ce35bb3a594406851bd195488a22

SHA256
5da0ed1228650a179464d75f8fc2d0e64ce87129b36572ab5e98a9650d794e19

SHA512
050dce1835b7ec7da39a44b707efe36d89b8aaa8ba8b2e39ce82350edda4660939e3afc69303c5d101d1b4a849e048b793fa26a524609d2b05f922f809c3863e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
99a55f1dc87afbb196de7cc3e22ebdc7

SHA1
a7e1f7f44dfc211149898165c1abc5c1af662583

SHA256
a67402a64b5d9f4231beab3733b4e5ef67038367acdc5abefd47c1052b2c6184

SHA512
8dc24997e72558ad797c2aa4e7373e1335a4015113dc87d7e080414815b6f70e074e44b4fec685e1ac7a11821b034ce824b7fe006bbbcfcfe6daf0751f1172d1

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
4.3MB

MD5
951f19a10c46fcbe3d0e2e3169628fb0

SHA1
3ea603d5fac272b14aa3bd02f6f6e49e2326c2cc

SHA256
42464c5a066ca66d3b991ccc4138ef8cd5c289485396564b8470b87700226f06

SHA512
3a1dde9646905f37e6b93494bf3d1f4b2bec2fa2deac009634cac2445ec2e33bdb58f29bbd11120710f1c266b38e630769f4197ab86ef613b91b3eddd6506920

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
4.3MB

MD5
17317a0d0677483c9ef9da054d979078

SHA1
cf1bb0aff960210d9bbc878f051777059ebe72d6

SHA256
617421ae86e5e61e2475a1a2ac86f2ac5bc99e66130ff9b6ae1b032f25916018

SHA512
12089e5b77fb6932be73e82474b89720f751307e60e37dd4a6860541caedd3450b5f9a29b8adfcc0c0092daf2053efcc57208a06b06162d08e66ba9651ca1211

Download Submit
memory/1348-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2712-9-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2712-94-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads