eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e

General

Target

eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe
Size

1.2MB
MD5

34c95948578fc5abf9377112cb759f64
SHA1

8f48d608e396c5ef35ef85aa44ffe6b8511cabf6
SHA256

eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e
SHA512

4df7aee2563fd7b73cd4b65e1221b036d4f514680d92ec864d6916d4debbc0c745d1e0c6acb5b543f932fbbf982a6e3129ef9593ad9b34560df828b43ac42aa4
SSDEEP

24576:TL2gPr39qoj5l6gludTpyaJG9A5HPe3fHQmXqw1wi9D9E2A+:f2uqLgWT/JGe5dmawai9D9TA+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4336	WORDºÍ~1.EXE
4328	SERVER.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2144	4328	WerFault.exe	81
4216	4328	WerFault.exe	81
1108	4328	WerFault.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4336	WORDºÍ~1.EXE
4336	WORDºÍ~1.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4336	4856	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe	79
PID 4856 wrote to memory of 4336	4856	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe	79
PID 4856 wrote to memory of 4336	4856	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe	79
PID 4856 wrote to memory of 4328	4856	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe	81
PID 4856 wrote to memory of 4328	4856	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe	81
PID 4856 wrote to memory of 4328	4856	eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe	81

C:\Users\Admin\AppData\Local\Temp\eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe
"C:\Users\Admin\AppData\Local\Temp\eaf6b9966123c5a09ad610e2bff659110a8a23f0178bb693cc4a2f375742816e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WORDºÍ~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WORDºÍ~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 220
    3⤵
    - Program crash
    PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 228
    3⤵
    - Program crash
    PID:4216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 240
    3⤵
    - Program crash
    PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4328 -ip 4328
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4328 -ip 4328
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4328 -ip 4328
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER.exe

Filesize
468KB

MD5
591b3ae9dfec8765958d3c96cb7a2968

SHA1
319c2a08f0d77102431b00c65f39856d2481e6bc

SHA256
97f284d87b374bebd5bb3787f45099b31b4e4fd8165616fb30abaff4b793d493

SHA512
ebd1ee94be3488856dbed30b25809bf35cb30ddfb4866e000ad38c407dbee770159fff7448492abad54e30b0657c8b1ffc520b8d92ec99b0ea793ca68baec74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER.exe

Filesize
468KB

MD5
591b3ae9dfec8765958d3c96cb7a2968

SHA1
319c2a08f0d77102431b00c65f39856d2481e6bc

SHA256
97f284d87b374bebd5bb3787f45099b31b4e4fd8165616fb30abaff4b793d493

SHA512
ebd1ee94be3488856dbed30b25809bf35cb30ddfb4866e000ad38c407dbee770159fff7448492abad54e30b0657c8b1ffc520b8d92ec99b0ea793ca68baec74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WORDºÍ~1.EXE

Filesize
736KB

MD5
50e97727ab59ff9701689c37bde72e84

SHA1
ad2b82722e3110b167f7d3c37212c355e1f87a05

SHA256
c7f8c646d9c14c58bcd1c0ceae7b74fa5c4cede7b0d782e69a90e53aedcde034

SHA512
7f708a0255e0647aea1dd50a98bd97969baa19d6403abbb9a5e17d68858ac10c4d66badbab292b962cfca421a1252045232c9926308563e01a237044196eb71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WORDºÍ~1.EXE

Filesize
736KB

MD5
50e97727ab59ff9701689c37bde72e84

SHA1
ad2b82722e3110b167f7d3c37212c355e1f87a05

SHA256
c7f8c646d9c14c58bcd1c0ceae7b74fa5c4cede7b0d782e69a90e53aedcde034

SHA512
7f708a0255e0647aea1dd50a98bd97969baa19d6403abbb9a5e17d68858ac10c4d66badbab292b962cfca421a1252045232c9926308563e01a237044196eb71a

Download Submit
memory/4328-146-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4328-145-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4336-140-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4336-141-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4336-138-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4856-139-0x0000000000560000-0x00000000005B4000-memory.dmp

Filesize
336KB

Download
memory/4856-132-0x0000000001000000-0x000000000120B000-memory.dmp

Filesize
2.0MB

Download
memory/4856-134-0x0000000001000000-0x000000000120B000-memory.dmp

Filesize
2.0MB

Download
memory/4856-133-0x0000000000560000-0x00000000005B4000-memory.dmp

Filesize
336KB

Download
memory/4856-147-0x0000000001000000-0x000000000120B000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing