523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9

Analysis

max time kernel
65s
max time network
70s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
17/07/2022, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
Size 1.4MB
Sample220717-d9vxtaeed3
SHA256 523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9
MD5 7f0ac479ef241a90cc85b105cb450141
SHA1 4ba8d7dd21ec2cdb549e4d6081d50a6e4995bda3
SHA512 b480a860d9e9bfd5f6c8254e87f2dc9f64d01270ef6bd45c584435482b39375551d7ad5f3b61b8d94b2e2d9ba6c80f2097bd6521f468338e208782b0b17a3632
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://c.statcounter.com/9845037/0/5d76be22/1/
exe.dropper
http://shortit.icu/dseeda
exe.dropper
http://shortit.icu/fffdsfe

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	1052	powershell.exe
7	1052	powershell.exe
9	1052	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 736 set thread context of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 736 wrote to memory of 1984	736	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	27
PID 1984 wrote to memory of 1052	1984	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	28
PID 1984 wrote to memory of 1052	1984	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	28
PID 1984 wrote to memory of 1052	1984	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	28
PID 1984 wrote to memory of 1052	1984	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	28

C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
"C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:736
- C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
  "C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -Exec Bypass "& '.\last.ps1'
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

last.ps1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\last.ps1
Size 1KB
SHA256 45fc6821f58cd252eb2c1371d238bc0a1abd9c8448f27970d8eaf374a3bcfc78
MD5 6833ae48a19cc215ae93b1e6478c855e
SHA1 72c8090dac80eeb34096563693b06d6d0d9ad0ec
SHA512 e7c57100323a031ba59444b25f76da1b6c30af16395d02f2718e0ea952443aa2e70f09e83e2c0e4c78b4038a30c848519329f1d9d64c540a7959a3f21f97af15
MD5 SHA1 SHA512

Submit Download

memory/736-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Download

memory/1052-75-0x0000000073B50000-0x00000000740FB000-memory.dmp

Download

memory/1052-74-0x0000000073B50000-0x00000000740FB000-memory.dmp

Download

memory/1052-72-0x0000000073B50000-0x00000000740FB000-memory.dmp

Download

memory/1984-59-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-65-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-68-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-63-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-71-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-61-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-58-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-56-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-55-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-76-0x0000000000400000-0x000000000043F000-memory.dmp

Download