ff536d51ab667c0546c33352c460bbceb6722d333932ba992364b032cba6af1e

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-05-2022 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4253f3ea96808cba77b8ceb0f76d1d4.exe
Size

1.2MB
MD5

b4253f3ea96808cba77b8ceb0f76d1d4
SHA1

d4b776ae1c0fa40c532a812dd69cd199e1fef94e
SHA256

ff536d51ab667c0546c33352c460bbceb6722d333932ba992364b032cba6af1e
SHA512

bceebeb1435b0858b9462ad42fdab065c81f90db8f8ea19c6d08d14574720ec71a260b6675180362db9639d5707b0a11c7b6027d7c8e1055ba06a30c7cfb0c90

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b4253f3ea96808cba77b8ceb0f76d1d4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b4253f3ea96808cba77b8ceb0f76d1d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b4253f3ea96808cba77b8ceb0f76d1d4.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b4253f3ea96808cba77b8ceb0f76d1d4.exe

description	pid	process	target process
PID 1632 wrote to memory of 1292	1632	b4253f3ea96808cba77b8ceb0f76d1d4.exe	sc.exe
PID 1632 wrote to memory of 1292	1632	b4253f3ea96808cba77b8ceb0f76d1d4.exe	sc.exe
PID 1632 wrote to memory of 1292	1632	b4253f3ea96808cba77b8ceb0f76d1d4.exe	sc.exe
PID 1632 wrote to memory of 1292	1632	b4253f3ea96808cba77b8ceb0f76d1d4.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\b4253f3ea96808cba77b8ceb0f76d1d4.exe
"C:\Users\Admin\AppData\Local\Temp\b4253f3ea96808cba77b8ceb0f76d1d4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\sc.exe
sc -?
2⤵
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x0000000000000000-mapping.dmp

Download