Analysis
-
max time kernel
146s -
max time network
60s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
29-05-2020 14:50
Static task
static1
Behavioral task
behavioral1
Sample
good.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
good.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
good.exe
-
Size
117KB
-
MD5
3656d2dfcd4f9ebf97e03fa2c9a05ade
-
SHA1
bd9ecbe901ff4366c789fa63eaffdda9d3f4e931
-
SHA256
b479533a51ba629bd5f20a7e9faa3bcccfddc72218b23dfd5a4ab15825204944
-
SHA512
2eb3f78eb1e6dd34563c78a5bd656813a4e80f49676a9fec5ab33290b9fa487d8817ff5cf8c3241031fadf0a010c8a0bf3c9afa5dda9e5c519838a3089350738
Score
6/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
good.execmd.exedescription pid process target process PID 3008 wrote to memory of 3624 3008 good.exe cmd.exe PID 3008 wrote to memory of 3624 3008 good.exe cmd.exe PID 3008 wrote to memory of 3624 3008 good.exe cmd.exe PID 3624 wrote to memory of 2908 3624 cmd.exe WScript.exe PID 3624 wrote to memory of 2908 3624 cmd.exe WScript.exe PID 3624 wrote to memory of 2908 3624 cmd.exe WScript.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
good.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce good.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" good.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\good.exe"C:\Users\Admin\AppData\Local\Temp\good.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
-
C:\Windows\SysWOW64\cmd.execmd /c title ok && config.jse && type dr.txt && exit2⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\config.jse"3⤵