7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-10-2022 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c34729173ecc820eb7674431597d78be.exe
Size

427KB
MD5

c34729173ecc820eb7674431597d78be
SHA1

884f343876a8bb0ebac63c28191c22c6f69590f8
SHA256

7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
SHA512

f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0
SSDEEP

3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SETUP_~1.EXE

pid process

1340 SETUP_~1.EXE

pid	process
1340	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c34729173ecc820eb7674431597d78be.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	c34729173ecc820eb7674431597d78be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c34729173ecc820eb7674431597d78be.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SETUP_~1.EXE

description pid process

Token: SeDebugPrivilege 1340 SETUP_~1.EXE

description	pid	process
Token: SeDebugPrivilege	1340	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c34729173ecc820eb7674431597d78be.exe

description	pid	process	target process
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE
PID 1964 wrote to memory of 1340	1964	c34729173ecc820eb7674431597d78be.exe	SETUP_~1.EXE

C:\Users\Admin\AppData\Local\Temp\c34729173ecc820eb7674431597d78be.exe
"C:\Users\Admin\AppData\Local\Temp\c34729173ecc820eb7674431597d78be.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
214.6MB

MD5
4786de75433835fdc9d3d08edf8116ca

SHA1
2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

SHA256
d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

SHA512
e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
214.6MB

MD5
4786de75433835fdc9d3d08edf8116ca

SHA1
2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

SHA256
d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

SHA512
e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

Download Submit
memory/1340-54-0x0000000000000000-mapping.dmp

Download
memory/1340-57-0x0000000000110000-0x0000000000122000-memory.dmp

Filesize
72KB

Download
memory/1340-58-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download