a233b76767157c012c4d1ec34726d87ea1efac01e49efd9fef394c7e84966103

Analysis

max time kernel
122s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 900KB
Sample221003-kfvhhsfcb9
SHA256 a233b76767157c012c4d1ec34726d87ea1efac01e49efd9fef394c7e84966103
MD5 c340449d532642420d4bedc2e9f7ce7c
SHA1 6153df468674d2eb1680eb6bb0e1bdbc0d6856b7
SHA512 c9a085e30ed056c819b992bbe34d606d9fca0704362917ad226b64d233b4800be5fb9de35150f2cdd6bc0f3f1132ac77f558f00dd27ca8d474df4a056a7ff4d3
SSDEEP 12288:5S7lrM9H8y8ea2SONB3/FI3o+fQqZ/pXVrMkM0ke4jNHUJopuBXidpX1ScBl/2GE:eM9H9MMIh4qZRVgtjOoAYX1SgB74j/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3980	Tanks.exe.pif
1300	Tanks.exe.pif

Loads dropped DLL 6 IoCs

pid	Process
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 1300	3980	Tanks.exe.pif	97

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4472	tasklist.exe
4832	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1104	PING.EXE
3472	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3980	Tanks.exe.pif
3980	Tanks.exe.pif
3980	Tanks.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1600	604	file.exe	84
PID 604 wrote to memory of 1600	604	file.exe	84
PID 604 wrote to memory of 1600	604	file.exe	84
PID 604 wrote to memory of 4064	604	file.exe	86
PID 604 wrote to memory of 4064	604	file.exe	86
PID 604 wrote to memory of 4064	604	file.exe	86
PID 4064 wrote to memory of 3748	4064	cmd.exe	88
PID 4064 wrote to memory of 3748	4064	cmd.exe	88
PID 4064 wrote to memory of 3748	4064	cmd.exe	88
PID 3748 wrote to memory of 4472	3748	cmd.exe	89
PID 3748 wrote to memory of 4472	3748	cmd.exe	89
PID 3748 wrote to memory of 4472	3748	cmd.exe	89
PID 3748 wrote to memory of 4488	3748	cmd.exe	90
PID 3748 wrote to memory of 4488	3748	cmd.exe	90
PID 3748 wrote to memory of 4488	3748	cmd.exe	90
PID 3748 wrote to memory of 4832	3748	cmd.exe	91
PID 3748 wrote to memory of 4832	3748	cmd.exe	91
PID 3748 wrote to memory of 4832	3748	cmd.exe	91
PID 3748 wrote to memory of 4476	3748	cmd.exe	92
PID 3748 wrote to memory of 4476	3748	cmd.exe	92
PID 3748 wrote to memory of 4476	3748	cmd.exe	92
PID 3748 wrote to memory of 2728	3748	cmd.exe	93
PID 3748 wrote to memory of 2728	3748	cmd.exe	93
PID 3748 wrote to memory of 2728	3748	cmd.exe	93
PID 3748 wrote to memory of 3980	3748	cmd.exe	94
PID 3748 wrote to memory of 3980	3748	cmd.exe	94
PID 3748 wrote to memory of 3980	3748	cmd.exe	94
PID 3748 wrote to memory of 1104	3748	cmd.exe	95
PID 3748 wrote to memory of 1104	3748	cmd.exe	95
PID 3748 wrote to memory of 1104	3748	cmd.exe	95
PID 4064 wrote to memory of 3472	4064	cmd.exe	96
PID 4064 wrote to memory of 3472	4064	cmd.exe	96
PID 4064 wrote to memory of 3472	4064	cmd.exe	96
PID 3980 wrote to memory of 1300	3980	Tanks.exe.pif	97
PID 3980 wrote to memory of 1300	3980	Tanks.exe.pif	97
PID 3980 wrote to memory of 1300	3980	Tanks.exe.pif	97
PID 3980 wrote to memory of 1300	3980	Tanks.exe.pif	97
PID 3980 wrote to memory of 1300	3980	Tanks.exe.pif	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\at.exe
  at 3874982763784yhwgdfg78234789s42809374918uf
  2⤵
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Film.aspx & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4472
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:4488
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:4476
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^otPcqYaF$" Deliver.aspx
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
      Tanks.exe.pif A
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
        5⤵
        Executes dropped EXE
        
        PID:1300
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:1104
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:3472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Accurate.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Accurate.aspx
Size 891KB
SHA256 8d9c5d3eb7d4bfeb8ab1c5f4dde38dea52624ed80b188648fbab2ada88505ae4
MD5 ffc713ff8173dac3c96bc583eb916705
SHA1 3c1b3e1eb258e304722ecc876820a470d491467d
SHA512 8af86a88e0bb60941ec5a55678c97f9a25518f2e140fc2e792115cb653b5f5a745630d970492565944116f3c5e5dc053c22b60ad8287ce5b921e47371125bc8f
SSDEEP 12288:nN6+5nH9ZEi9woKYE8viiQlCE9KBgmHljq66Q2E2o:oinH9p9wKDQtKBgmHljq66Q2E2o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deliver.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Deliver.aspx
Size 924KB
SHA256 8b21bc4f93cc9a8438ec08d1385f2d7dead6291a741fdfe7b6960c9f9917f6b3
MD5 701381da8e4a87f18a22b98eee09a22b
SHA1 f5ff5c1714155b853a8335b1d359a010c012c596
SHA512 55ef35ce31c1fac2ff91efb3b4a5f646f3cfc7a0c4592f9da3e444a6472203608e224cf55dfa5c79025247c41aa8cbad759ef65dee9f95fe5c244dee239dc141
SSDEEP 24576:eErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:e86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Film.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Film.aspx
Size 12KB
SHA256 7903967eca6727d611e46d666d2871d4438e9bc65ea185e01787c8a8a3e5ce70
MD5 8eb593f08a4cca9959a469af6528ac0d
SHA1 8f4ae3c90b6d653eb75224683358f12dfc442dca
SHA512 631403ca6e37a317158ba583e5b0f05e83157abc4cb4865f8d0d8f6e11ef39ab150fe948961aebcaff5c01ace0345ca6dc3882306ab0ce84eec6c1dfdf822ca9
SSDEEP 384:94XaBCQseNkQdMsChfL/8b7kGSofLZbrGS2efv/r:94KYQse/7L8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tanks.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tanks.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tanks.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEvsgieS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEvsgieS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEvsgieS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEvsgieS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEvsgieS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEvsgieS.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1300-158-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1300-153-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1300-161-0x0000000000F20000-0x0000000000F2D000-memory.dmp

Download

memory/1300-160-0x00000000007F0000-0x00000000007F9000-memory.dmp

Download

memory/1300-159-0x0000000000400000-0x0000000000435000-memory.dmp

Download