02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75

Analysis

max time kernel
80s
max time network
86s
platform
windows7_x64
resource
win7-20220414-en
submitted
28/05/2022, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe
Size 1.8MB
Sample220528-c8swdsdhc8
SHA256 02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75
MD5 3ab71f5cbfac7d5c8eeed07ce6e08c82
SHA1 504efc05b11d2daf8ff364ab524614407f08de11
SHA512 87227fbd97fff57c677fcbf1b5bb836e73c0b4d65162c69f9fcf3e3cab8aeab2f8abbaba2a4df232cdeafc965936b52e9c37ba5ae5f69bc3967d49e4d05ac40f
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
532	Fina.com
1388	Fina.com

Loads dropped DLL 2 IoCs

pid	Process
1240	cmd.exe
532	Fina.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
564	PING.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1760	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	28
PID 1828 wrote to memory of 1760	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	28
PID 1828 wrote to memory of 1760	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	28
PID 1828 wrote to memory of 1760	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	28
PID 1828 wrote to memory of 1468	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	30
PID 1828 wrote to memory of 1468	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	30
PID 1828 wrote to memory of 1468	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	30
PID 1828 wrote to memory of 1468	1828	02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe	30
PID 1468 wrote to memory of 1340	1468	cmd.exe	32
PID 1468 wrote to memory of 1340	1468	cmd.exe	32
PID 1468 wrote to memory of 1340	1468	cmd.exe	32
PID 1468 wrote to memory of 1340	1468	cmd.exe	32
PID 1468 wrote to memory of 1240	1468	cmd.exe	33
PID 1468 wrote to memory of 1240	1468	cmd.exe	33
PID 1468 wrote to memory of 1240	1468	cmd.exe	33
PID 1468 wrote to memory of 1240	1468	cmd.exe	33
PID 1240 wrote to memory of 1536	1240	cmd.exe	34
PID 1240 wrote to memory of 1536	1240	cmd.exe	34
PID 1240 wrote to memory of 1536	1240	cmd.exe	34
PID 1240 wrote to memory of 1536	1240	cmd.exe	34
PID 1240 wrote to memory of 1136	1240	cmd.exe	35
PID 1240 wrote to memory of 1136	1240	cmd.exe	35
PID 1240 wrote to memory of 1136	1240	cmd.exe	35
PID 1240 wrote to memory of 1136	1240	cmd.exe	35
PID 1240 wrote to memory of 532	1240	cmd.exe	36
PID 1240 wrote to memory of 532	1240	cmd.exe	36
PID 1240 wrote to memory of 532	1240	cmd.exe	36
PID 1240 wrote to memory of 532	1240	cmd.exe	36
PID 1240 wrote to memory of 564	1240	cmd.exe	37
PID 1240 wrote to memory of 564	1240	cmd.exe	37
PID 1240 wrote to memory of 564	1240	cmd.exe	37
PID 1240 wrote to memory of 564	1240	cmd.exe	37
PID 532 wrote to memory of 1388	532	Fina.com	38
PID 532 wrote to memory of 1388	532	Fina.com	38
PID 532 wrote to memory of 1388	532	Fina.com	38
PID 532 wrote to memory of 1388	532	Fina.com	38

C:\Users\Admin\AppData\Local\Temp\02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe
"C:\Users\Admin\AppData\Local\Temp\02c9ff836b50937d98fbd5d0dd0c67393554af5f43cf7b3f908f7be57230fe75.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c MheVKsJRr
  2⤵
  PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c certutil -decode Pura.docm Accendeva.wks & cmd < Accendeva.wks
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\certutil.exe
    certutil -decode Pura.docm Accendeva.wks
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^tIngObftTiWFqKZENvghIr$" Audacia.xlm
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -decode Miro.xlt c
      4⤵
      PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
      Fina.com c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com c
        5⤵
        Executes dropped EXE
        
        PID:1388
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Accendeva.wks

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Accendeva.wks
Size 29KB
SHA256 a493c7bf9a7cff0ff4e529bebdf72ea0090546d59487b74ed4fa7e5bee5ead97
MD5 900229807f3307189a71a44dbb2a8279
SHA1 25f08b6ee281cd0be0c8514f8a5a0a1c1e483f05
SHA512 b15f66b6875353f483b0f64010c261de7b1e203314e7e49fa0f9f916027fc260dc9adc7fd6184d332053c11b7aa20ea17c75a1aae4de2102d686c2c8e8f5b631
SSDEEP 768:jlvABjHM7FHPG1gcWaBHvLjkAO2YvYDNlN/Pbuhyb+c5YbaOb:JBvG1gcWKLjhO5sp6eYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Audacia.xlm

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Audacia.xlm
Size 921KB
SHA256 c64729f4c7fadf618f793ea1f554ef87858bc1ec1d86cc1247292d0afd9a607d
MD5 eeccf5b2c53f3a30f99a2b16b46cd0e7
SHA1 ebd0a3de47dc05e259da9e7d25ca50c8e89bbb27
SHA512 1d455f0fe0ff77b53d0e88f81fcc3b0ff7af05ac427c4060708350c5ae331e6d8b2f8bdbfea74efac08b0b02a0976b73bba6b8e8710a7be8a8b579be4b7097e9
SSDEEP 24576:VJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:VC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fina.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fina.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fina.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miro.xlt

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Miro.xlt
Size 972KB
SHA256 52685c6d22c65dce751cc47a8326a2d6d6ac54846ab862144c98e44ed65c70ef
MD5 66c8cbab023e66728443436c39ac5825
SHA1 8355639fbed2d5da116e636b0d711874b3c31068
SHA512 d81380119ea5c1cd0061216c97e24e8044ebe96252037e644729fa8a9793786bbec14db9dca3fc7090780a9784345ed9972a4211186c41eee5dd096f1f26b2a2
SSDEEP 12288:oDs0I2YuqkyOyKTSfySaQs4WWu4b6cLZ7EdLiKTAhuQXkBF:JjOyKTSfySyWu4bxLlCLiKT5Dj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pura.docm

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pura.docm
Size 41KB
SHA256 49a10d1703545e5024ac4dbdff0c0fb30b50b0e9a9d259a3b4124fa3e6405d40
MD5 0df32e52cb1785a0d786291e06fb85b1
SHA1 31b3751fd5c954f581f0ef971d1de3aa8ae13ee9
SHA512 0b0c137c569d60ccc8089d7e07035d142ad5ff684a8fddcd1dc5ba200debc54d7d92ba2dcca1a541529b87a668a6606fffb11d9921b384f126ab11c5073c1850
SSDEEP 768:VXsBUNvpmvyRYsI0+U1tlycotMMKLEGjulhpDI7llzJze2RGiosJyI:NpNvYQj+UIcoyEGylbI7XztLUg3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tu.vsd

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tu.vsd
Size 888KB
SHA256 d001b279e67c60cc7b0e0916ec8e766b846fda81019b97305fba1b357a30fd0b
MD5 9589108921fd10b8a39e8b0e1b21a807
SHA1 cf272749e903a04d30e1416248ed1effe6b78076
SHA512 248f590a2831f554faf10c3ee22d264882cee47c6c35830b88d077ed0e133b4c8d580e1fb321e5dfddd6febce4c6c7e6bd24dc8c1b4528fbb397d2ac80019047
SSDEEP 12288:igK1ZNZMYQc8k0x5tUs/IzWiRIJ6zeWr3/tOltsA4FZNtuBrRUFN3a/Jg:S10c506fz9SEzHhOB4TANE8/+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c
Size 706KB
SHA256 42953c0b383378887c4f5ca840b7a96c4ce0b91d4059519065e9ebcf9e2a37fe
MD5 5fbde0b3674111e38f94b032d57e9050
SHA1 163f400ffc1881475f29dc9511698c1578d59824
SHA512 071ff379f75a5e4365f1ec9c2e86d871c871e50f7593bfe8bfe8b849ed56f7431a1f551b749e50c822f67bca5ac74f33cb461ec28c7d700a524b49db1d5a7683
SSDEEP 12288:LvjrdqmsUjyrwd97k8Wvs5ZM62qu9gEq5avg2fs2YPL/Ge6sy6NsPXVTeJr4BxUW:3IBrE1WTqy+sKJcHU14ffuNfyrXr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fina.com

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fina.com

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Fina.com
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-57-0x0000000076191000-0x0000000076193000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads