Overview

overview

10

Static

static

3

0aa9c3d901...82.exe

windows7-x64

10

0aa9c3d901...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 13:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe

  • Size

    1.1MB

  • MD5

    59b7ec85012da5fa1028820d2f97e507

  • SHA1

    61653b380392efd0d218aa87705f87109ee2684b

  • SHA256

    0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882

  • SHA512

    e0a02d223bb8758eb51b941daad84dca6b1520aa053e762954f7987339027ec7aa0d32d344580efe5a3a508c760619769d90517496bcd8bd6cb62c0d9e4e5f9f

  • SSDEEP

    24576:XJZEZJPVUVTmTj0CfOZuzhg1HREnUjwSGvQ+giNxMOacZR:XJZEPPMT2j0CGZuimnUVGvQ+giNOOPR

Score
10/10
aspackv2credential_accessdiscoverypersistenceransomwarestealerupx

Malware Config

Extracted

Path

F:\System Volume Information\Help.hta

Ransom Note
<html><head><meta charset='UTF-8'><title>RECOVERY TOOL</title><HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu='no'> <script>window.moveTo(50,50);window.resizeTo(screen.width-100,screen.height-100);</script><style type='text/css'>body{background:#000}.b{font:120%;font-weight:bold;color:#fff}.a{background:#f00;border-left:10px}.q{text-align:center;font:200%;font-weight:bold;margin-bottom:20px;color:#fff}</style></head><body><div class='q'>FILES ARE ENCRYPTED</div><div class='b'>All your files were encrypted and important data was copied to our storage</br>If you want to recover files, contact the operator in the TOX application, enter YOUR ID <font color=Lime> rnovvmko2</font></br>Add the ID <font color=Blue>3CC7CCEF369D6A7A4F6CAD11D12D7DE671909962944A7D034282F1F7B54F9D3522E570232A0B</font> of your personal operator as a friend so that you can start chatting.</br>If the Operator did not respond within 24 hours or encountered any problem then send an email to our support <font color=Blue>[email protected]</font></br>In the header of the letter, indicate your ID and attach 2-3 infected files to generate a private key and compile the decryptor</br>Files should not have important information and should not exceed the size of more than 5 MB</br>After receiving the ransom, we will send a recovery tool with detailed instructions within an hour and delete your files from our storages</div></br><div class='a'><div class='q'>Attention</div><ul><div class='b'><li>Do not rename encrypted files.</li><li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li><li>If you refuse to pay the ransom, Important Data that contains personal confidential information or trade secrets will be sold to third parties interested in them.</br>In any case, we will receive a payment, and your company will face problems in law enforcement and judicial areas.</li></div></ul></div><script language='VBScript'> On Error Resume Next set S=CreateObject("Wscript.shell") utox=S.ExpandEnvironmentStrings("%windir%\utox.exe") If not CreateObject("Scripting.FileSystemObject").FileExists(utox) Then MsgBox "Find and download UTOX.EXE file on the Internet and start..." End If S.Run utox & " -p",1 </script></body></html>
Emails

color=Blue>[email protected]</font></br>In

Signatures

  • Renames multiple (20667) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\system32\backgroundTaskHost.exe
      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
      2⤵
        PID:700
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
        2⤵
          PID:4104
        • C:\Windows\system32\wbem\wmiprvse.exe
          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          2⤵
            PID:1312
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
            2⤵
              PID:3252
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:3188
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:5032
                • C:\Windows\System32\mousocoreworker.exe
                  C:\Windows\System32\mousocoreworker.exe -Embedding
                  2⤵
                    PID:972
                  • C:\Windows\system32\backgroundTaskHost.exe
                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                    2⤵
                      PID:5012
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                      2⤵
                        PID:4792
                      • C:\Windows\system32\backgroundTaskHost.exe
                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                        2⤵
                          PID:5920
                        • C:\Windows\system32\backgroundTaskHost.exe
                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                          2⤵
                            PID:6124
                          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                            2⤵
                              PID:1884
                            • C:\Windows\system32\backgroundTaskHost.exe
                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                              2⤵
                                PID:7512
                              • C:\Windows\system32\DllHost.exe
                                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                2⤵
                                  PID:7336
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                1⤵
                                • Drops startup file
                                • Drops desktop.ini file(s)
                                • Drops file in Program Files directory
                                PID:508
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                1⤵
                                • Drops startup file
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                PID:1144
                              • C:\Windows\Explorer.EXE
                                C:\Windows\Explorer.EXE
                                1⤵
                                • Drops startup file
                                • Drops file in Program Files directory
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of WriteProcessMemory
                                PID:3480
                                • C:\Users\Admin\AppData\Local\Temp\0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe
                                  "C:\Users\Admin\AppData\Local\Temp\0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4012
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /c del "C:\Users\Admin\AppData\Local\Temp\0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe" >> NUL
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2324
                                • C:\Windows\SysWOW64\mshta.exe
                                  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\Help.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                  2⤵
                                  • Checks computer location settings
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:6084
                                  • C:\Windows\utox.exe
                                    "C:\Windows\utox.exe" -p
                                    3⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:5080
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 544
                                      4⤵
                                      • Program crash
                                      PID:3304
                              • C:\Users\Admin\AppData\Local\Temp\0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe
                                C:\Users\Admin\AppData\Local\Temp\0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe
                                1⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1184
                                • C:\Windows\SysWOW64\cmd.exe
                                  /c del "C:\Users\Admin\AppData\Local\Temp\0aa9c3d901f7d0447417ca0d7315dec99f1607efd397a660365b3be601ddd882.exe" >> NUL
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2964
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5080 -ip 5080
                                1⤵
                                  PID:2872
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x50c 0x514
                                  1⤵
                                    PID:5592
                                  • C:\Windows\SysWOW64\werfault.exe
                                    werfault.exe /h /shared Global\ba8c1c11982d40d9856dafd84bdc2c50 /t 6204 /p 6084
                                    1⤵
                                      PID:7820

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk rnovvmko2.wait
                                      Filesize

                                      1KB

                                      MD5

                                      5b6f02e587ad0a1a3f81f6cab833a62c

                                      SHA1

                                      4201e2ae283be8a1c4c53e9ec19a4a1c8e8fa51f

                                      SHA256

                                      810b3bff2c01d82747ab328a8085b9d8ca905240327e41be8a1539ffe41d12de

                                      SHA512

                                      b5b90806c6d26bc1aadf3241c6ff8ff7ed6d78fdb30ca4c60da333218a3d0e565b91dfcf0e6bf83720d874a45e24138bb54352e06c2406f2b898a165d0ad7c0b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk rnovvmko2.wait
                                      Filesize

                                      2KB

                                      MD5

                                      3e51ccd634316a769e4a2b4c3eeac0d8

                                      SHA1

                                      fd1dd8e33a406a269a9cbaacb954d5ac1ccfa867

                                      SHA256

                                      1ff93bf24cac1e597b90713f9997c50136593a2aa60cb349d0701b4946e68524

                                      SHA512

                                      0f6256da476dbaed3caef6f7f5ffed5a8146f0e6bfddff6fe677194a1198b3207295f2d84c0d5363f8107f7c1ed0f4e0f88bc944c8451b98df67b8233fc1f7e7

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk rnovvmko2.wait
                                      Filesize

                                      3KB

                                      MD5

                                      c1db96e648d81f55d7e8f648f438f068

                                      SHA1

                                      06aa0c3fd964e71c3b806faa90548bae61285989

                                      SHA256

                                      5f7626a976eaad74f36f2535b8ddeca523a7b16e9e9b48466af7b518b66fb802

                                      SHA512

                                      a82babbb77d699d70823fe7520665faa7ad871569335e322793fdfbc3ca7377a1b7f84306fbc170f5af11a978e9d083a4326dc60a35cc4c5a58791872242c86e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk rnovvmko2.wait
                                      Filesize

                                      3KB

                                      MD5

                                      e69d82ae7cef047ded629a161133cce8

                                      SHA1

                                      173f6cbd127ed77ce9be3e020f3eb2e732f2f825

                                      SHA256

                                      b010e2594b5a603cf149a93e18b92bcd7af0f6b19ca18e31f03ec613e8dff743

                                      SHA512

                                      cad33eed5d3f889a4359b058dbee07c5b0ffe8af802a04ac2d1d74ef357d1e0302d0a72d7c2bc3f8e235a5e1cbe3f07c8b60224fd3a8625b4be932d4ba8aa589

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                      Filesize

                                      2KB

                                      MD5

                                      8abf2d6067c6f3191a015f84aa9b6efe

                                      SHA1

                                      98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                      SHA256

                                      ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                      SHA512

                                      c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                      Filesize

                                      2KB

                                      MD5

                                      f313c5b4f95605026428425586317353

                                      SHA1

                                      06be66fa06e1cffc54459c38d3d258f46669d01a

                                      SHA256

                                      129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                      SHA512

                                      b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan
                                      Filesize

                                      3KB

                                      MD5

                                      1babe42c0fe77bbcc6f201422e02a6f1

                                      SHA1

                                      01d659837044faba4b5133ca64ae3efcf2540b6a

                                      SHA256

                                      c168b05bf0e2c46c348a2280ba49516222bb389aa85ae25ba317424424790f49

                                      SHA512

                                      2e454f614797abba48ac813bcc155bdf0e15f57bfe97ad355b7c61c63ea44ad1b1f8fdda0ab3e6c8e68c46bd384d64d9901e643de89dbb48d8023b7ae25464cc

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                      Filesize

                                      2KB

                                      MD5

                                      ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                      SHA1

                                      a3879621f9493414d497ea6d70fbf17e283d5c08

                                      SHA256

                                      98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                      SHA512

                                      1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                      Filesize

                                      2KB

                                      MD5

                                      7d612892b20e70250dbd00d0cdd4f09b

                                      SHA1

                                      63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                      SHA256

                                      727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                      SHA512

                                      f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                      Filesize

                                      2KB

                                      MD5

                                      1e8e2076314d54dd72e7ee09ff8a52ab

                                      SHA1

                                      5fd0a67671430f66237f483eef39ff599b892272

                                      SHA256

                                      55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                      SHA512

                                      5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                      Download Submit

                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                      Filesize

                                      2KB

                                      MD5

                                      0b990e24f1e839462c0ac35fef1d119e

                                      SHA1

                                      9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                      SHA256

                                      a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                      SHA512

                                      c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                      Download Submit

                                    • C:\Windows\utox.exe
                                      Filesize

                                      1.1MB

                                      MD5

                                      431d094d2b0a95ab73a1253da8d87083

                                      SHA1

                                      5e600438a2f7c911baa848bdaa322acbf3492c98

                                      SHA256

                                      c418b88bc52442b3469eb882c277aa6ffbf87350887faadaa937baf75df5d5af

                                      SHA512

                                      31953304845f99b732242a13ee868a09fc732ca6c21c3add7b0acfaea557e40ece8d1d625c76cd233ea5c58f3df6d1a68bc38d197d17dfecd4745670e1e5bbbf

                                      Download Submit

                                    • F:\System Volume Information\Help.hta
                                      Filesize

                                      2KB

                                      MD5

                                      e5be97e5ee04e3a36020dfd56d46046b

                                      SHA1

                                      74fe893a8b86504289a72ed6250d9d0e7d565d20

                                      SHA256

                                      e58652dfdc3593ea49ead0114400afe2dd710dda6e3f84abc288e015b4068f4d

                                      SHA512

                                      b9f3a8a2ceafb475588ed3db37bac533ccb0489e4fe502ad12b9b31e6e85b40017b10ace311486766e94a67614e15fd6195616b9288b28443f919af56373c950

                                      Download Submit

                                    • memory/508-3-0x0000020AA0D80000-0x0000020AA0DB2000-memory.dmp

                                      Filesize

                                      200KB

                                      Download

                                    • memory/784-1-0x000002A1EEAB0000-0x000002A1EEAB4000-memory.dmp

                                      Filesize

                                      16KB

                                      Download

                                    • memory/5080-24444-0x0000000000400000-0x0000000000808000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/5080-64801-0x0000000000400000-0x0000000000808000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download