Analysis
-
max time kernel
144s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
29-05-2020 14:50
Static task
static1
Behavioral task
behavioral1
Sample
good.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
good.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
good.exe
-
Size
117KB
-
MD5
3656d2dfcd4f9ebf97e03fa2c9a05ade
-
SHA1
bd9ecbe901ff4366c789fa63eaffdda9d3f4e931
-
SHA256
b479533a51ba629bd5f20a7e9faa3bcccfddc72218b23dfd5a4ab15825204944
-
SHA512
2eb3f78eb1e6dd34563c78a5bd656813a4e80f49676a9fec5ab33290b9fa487d8817ff5cf8c3241031fadf0a010c8a0bf3c9afa5dda9e5c519838a3089350738
Score
6/10
Malware Config
Signatures
-
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
good.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce good.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" good.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
good.execmd.exedescription pid process target process PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1008 wrote to memory of 1344 1008 good.exe cmd.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe PID 1344 wrote to memory of 1524 1344 cmd.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\good.exe"C:\Users\Admin\AppData\Local\Temp\good.exe"1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c title ok && config.jse && type dr.txt && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\config.jse"3⤵