43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae

General

Target

43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe
Size

689KB
MD5

a0ab900184337cbcffc3d563d2743300
SHA1

d11a8066629172b800cd1d355fb4dee09c31be8e
SHA256

43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae
SHA512

b8ff65459e0eee7f35999b553ee517e67c39d62bb7c2f1e8a8d6a16a898cb3a08a059f5913e0aec20856902bf3f61d92695ded61dff63927a22eb0479b12989f
SSDEEP

12288:Znb9ODA1RCpFn7AKCXUXNZPDavxU97lQT4mF3Z4mxxV0MHoTAFbD:db9kA1RgAKCX8NlZpmQmXVKi

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3716	4.exe
396	Windows.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Windows.com	4.exe
File opened for modification	C:\Windows\Windows.com	4.exe
File created	C:\Windows\uninstal.bat	4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	4.exe
Token: SeDebugPrivilege	396	Windows.com

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
396	Windows.com

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3716	5044	43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe	82
PID 5044 wrote to memory of 3716	5044	43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe	82
PID 5044 wrote to memory of 3716	5044	43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe	82
PID 396 wrote to memory of 2140	396	Windows.com	84
PID 396 wrote to memory of 2140	396	Windows.com	84
PID 3716 wrote to memory of 2800	3716	4.exe	85
PID 3716 wrote to memory of 2800	3716	4.exe	85
PID 3716 wrote to memory of 2800	3716	4.exe	85

C:\Users\Admin\AppData\Local\Temp\43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe
"C:\Users\Admin\AppData\Local\Temp\43cecf6450ff148c6f5ad97759af53a2ee13d49d98a5d83eb6e3b21ff4be3aae.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
    3⤵
    PID:2800

C:\Windows\Windows.com
C:\Windows\Windows.com
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

Filesize
747KB

MD5
a80cb176bf2e51566a527fea973de4e2

SHA1
900fa9884d6b717130e51aee572850ff5a197048

SHA256
0388ae22efbd98a9f165fd4640550d22fd2d50a6e4eb98650032b9c574422004

SHA512
99eee5bf31dbf4b86b669391b4fd417fc7c74f52f265fc3ba79f467eb445962e4f05901092531efcf86098692e5bcd50330c04cd32fac1aa228287a0c435a2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

Filesize
747KB

MD5
a80cb176bf2e51566a527fea973de4e2

SHA1
900fa9884d6b717130e51aee572850ff5a197048

SHA256
0388ae22efbd98a9f165fd4640550d22fd2d50a6e4eb98650032b9c574422004

SHA512
99eee5bf31dbf4b86b669391b4fd417fc7c74f52f265fc3ba79f467eb445962e4f05901092531efcf86098692e5bcd50330c04cd32fac1aa228287a0c435a2f1

Download Submit
C:\Windows\Windows.com

Filesize
747KB

MD5
a80cb176bf2e51566a527fea973de4e2

SHA1
900fa9884d6b717130e51aee572850ff5a197048

SHA256
0388ae22efbd98a9f165fd4640550d22fd2d50a6e4eb98650032b9c574422004

SHA512
99eee5bf31dbf4b86b669391b4fd417fc7c74f52f265fc3ba79f467eb445962e4f05901092531efcf86098692e5bcd50330c04cd32fac1aa228287a0c435a2f1

Download Submit
C:\Windows\Windows.com

Filesize
747KB

MD5
a80cb176bf2e51566a527fea973de4e2

SHA1
900fa9884d6b717130e51aee572850ff5a197048

SHA256
0388ae22efbd98a9f165fd4640550d22fd2d50a6e4eb98650032b9c574422004

SHA512
99eee5bf31dbf4b86b669391b4fd417fc7c74f52f265fc3ba79f467eb445962e4f05901092531efcf86098692e5bcd50330c04cd32fac1aa228287a0c435a2f1

Download Submit
C:\Windows\uninstal.bat

Filesize
150B

MD5
5edd682a8b1f2bf873300774f954ab03

SHA1
2cca4e743d02dbccf31b784ea26a60c03dcc9637

SHA256
a34c51ec5d2ac66ef75719e7dee61b6e89e74d054712438da2585ec92ce0865a

SHA512
916f0e846a38f63aae996e2a3957fa24fed3bcaa6add68c529e3cc0aa063dca49b98d42c92317bfc2f43d745c492e1e1e6f5db0c986b9682f4b9b0cf0afd7bd2

Download Submit
memory/5044-132-0x0000000001000000-0x0000000001110000-memory.dmp

Filesize
1.1MB

Download
memory/5044-133-0x0000000000570000-0x00000000005C4000-memory.dmp

Filesize
336KB

Download
memory/5044-137-0x0000000001000000-0x0000000001110000-memory.dmp

Filesize
1.1MB

Download
memory/5044-138-0x0000000000570000-0x00000000005C4000-memory.dmp

Filesize
336KB

Download
memory/5044-143-0x0000000001000000-0x0000000001110000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing