af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6

Analysis

max time kernel
129s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe
Size

143KB
MD5

668f2fdfd29e37014dbe44301d40ca29
SHA1

b1a6102631f0ea6e786064af3c2931ae1df5c0fc
SHA256

af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6
SHA512

53c2f0ba3f18d58bd534be04f46c28ccc4a3d71b94f15bbd0a88a919ed91ab959b64bb67991a65d8a2789a98780a65878ff1ae1f306443a546b0ab50c1bc88f6
SSDEEP

3072:BN6ZlSa+Ncq6/H5BruHKeLGlKIGL0Tj3I5skgY912vFqQGyhRci+fs:BylSx4OqeLMKIPISo2X6iZ

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4772	move.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	4772	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4772	4140	af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe	82
PID 4140 wrote to memory of 4772	4140	af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe	82
PID 4140 wrote to memory of 4772	4140	af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe	82

C:\Users\Admin\AppData\Local\Temp\af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe
"C:\Users\Admin\AppData\Local\Temp\af65a444d09523f745155c0f092e5e90b6092aebe6277e7353e68507714571a6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\move.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\move.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 544
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4772 -ip 4772
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\move.exe

Filesize
45KB

MD5
ede618f02098fbaedc921a4cc64f6528

SHA1
aa125a98579626b28d5edf6eef064a31e24d6e47

SHA256
b7d06cd6707dba231fcf4eba1cf71b176e26dc8c876cf1e86347cad53ff04adc

SHA512
1096877cde24f65da967134b4ad8070b1fcf3c5087b870fec70338fed37c141717204a4a0028c6749282b1d14b57fdc9bf159f6d4e38e901e60e143baea6640e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\move.exe

Filesize
45KB

MD5
ede618f02098fbaedc921a4cc64f6528

SHA1
aa125a98579626b28d5edf6eef064a31e24d6e47

SHA256
b7d06cd6707dba231fcf4eba1cf71b176e26dc8c876cf1e86347cad53ff04adc

SHA512
1096877cde24f65da967134b4ad8070b1fcf3c5087b870fec70338fed37c141717204a4a0028c6749282b1d14b57fdc9bf159f6d4e38e901e60e143baea6640e

Download Submit
memory/4140-132-0x0000000001000000-0x0000000001037000-memory.dmp

Filesize
220KB

Download
memory/4140-137-0x0000000001000000-0x0000000001037000-memory.dmp

Filesize
220KB

Download
memory/4772-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download