40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe
Size

94KB
MD5

19b5eb94a732de2a304cbd6db617718f
SHA1

7fa8a32fef92e9f7e9846d483d847b7a041f0fab
SHA256

40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9
SHA512

b58fd239ec42349ae57ce8ef09406db9c430e9d7281c7c496a6e0fcb6652c05453986dd5eab03a7fb2a804536391bbd2ce44edb07cf70996e2e367fe936c7c72
SSDEEP

1536:Sdyql1M7wIIEuti7rEYivykYkpaWj0OL+G7mJAm/lGAuJMLF4vsnXWkW3I6:SdV1Z1i3QKqSGCJr/lkJ6FQsnI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1932	sppsrv.exe

Deletes itself 1 IoCs

pid	Process
1752	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1932	sppsrv.exe
1932	sppsrv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpwunp.dat	40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe
File created	C:\Windows\SysWOW64\sppsrv.exe	40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1752	1948	40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe	28
PID 1948 wrote to memory of 1752	1948	40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe	28
PID 1948 wrote to memory of 1752	1948	40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe	28
PID 1948 wrote to memory of 1752	1948	40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe	28

C:\Users\Admin\AppData\Local\Temp\40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe
"C:\Users\Admin\AppData\Local\Temp\40a05a835c86150f4390d65e20add5607bb2a0cd23b70a31af2fe804a11969f9.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\_del.bat
  2⤵
  - Deletes itself
  PID:1752

C:\Windows\SysWOW64\sppsrv.exe
C:\Windows\SysWOW64\sppsrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_del.bat

Filesize
294B

MD5
312bfe411e2f14fc21a489af3fa6f9b4

SHA1
364af8c3343eafd21f45987be6bc1f89020d0b30

SHA256
d238ba5a0cfdae9adfc8b238a6b46725663eb683c7029385eed109c48c92f616

SHA512
3d3d2da92b1beea02d1be23da96b52e6ea3bdc60908b2f08b8a93b00c8ccb9c84d399e06cd998795b1feefe45e8659571b652788c47f302563d5a8167447d311

Download Submit
C:\Windows\SysWOW64\sppsrv.exe

Filesize
94KB

MD5
043cbe2e0f46418407936b50e3905e09

SHA1
346f7ae7e4e212622fed8fb4aa6209a12f750cc5

SHA256
52914dcd60b50a8f0775e0b1439b6ccd68e061c68bd1272fc30d74cfb932a41b

SHA512
6db1ca61e554afb2652ddb0fe50f998d57e302a9dddb7675c37f15afdf01f85d45f9ad65657c0579b67f7997b8c279506b988bb3c076b58774a1c9abda1504df

Download Submit
C:\Windows\SysWOW64\sppsrv.exe

Filesize
94KB

MD5
043cbe2e0f46418407936b50e3905e09

SHA1
346f7ae7e4e212622fed8fb4aa6209a12f750cc5

SHA256
52914dcd60b50a8f0775e0b1439b6ccd68e061c68bd1272fc30d74cfb932a41b

SHA512
6db1ca61e554afb2652ddb0fe50f998d57e302a9dddb7675c37f15afdf01f85d45f9ad65657c0579b67f7997b8c279506b988bb3c076b58774a1c9abda1504df

Download Submit
C:\Windows\SysWOW64\xpwunp.dat

Filesize
740B

MD5
1c5ce73e266a109e1507eaae75fcf514

SHA1
000f9fe5f338bc093fb7fd70244c8eb859a0e2a0

SHA256
b5be4a80a7ddc63654e28634f359dd4be39d925e1ad5791664c26522a8aad903

SHA512
77a717de5885ccddd31bc2f20d600c51cd9a8ccfcf6041110ce8ffe598be3375855be8acf1a26c36d0c14204f730485acd3ac321722d121e543d5eb9724a0973

Download Submit
\Windows\SysWOW64\sppsrv.exe

Filesize
94KB

MD5
043cbe2e0f46418407936b50e3905e09

SHA1
346f7ae7e4e212622fed8fb4aa6209a12f750cc5

SHA256
52914dcd60b50a8f0775e0b1439b6ccd68e061c68bd1272fc30d74cfb932a41b

SHA512
6db1ca61e554afb2652ddb0fe50f998d57e302a9dddb7675c37f15afdf01f85d45f9ad65657c0579b67f7997b8c279506b988bb3c076b58774a1c9abda1504df

Download Submit
\Windows\SysWOW64\sppsrv.exe

Filesize
94KB

MD5
043cbe2e0f46418407936b50e3905e09

SHA1
346f7ae7e4e212622fed8fb4aa6209a12f750cc5

SHA256
52914dcd60b50a8f0775e0b1439b6ccd68e061c68bd1272fc30d74cfb932a41b

SHA512
6db1ca61e554afb2652ddb0fe50f998d57e302a9dddb7675c37f15afdf01f85d45f9ad65657c0579b67f7997b8c279506b988bb3c076b58774a1c9abda1504df

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads