b4b8d49ce8ac2c756f6d65399e71a15fc46814f4aee055bcc99cbb7d1d50cd88

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 802KB
Sample221102-sefxqsccel
SHA256 b4b8d49ce8ac2c756f6d65399e71a15fc46814f4aee055bcc99cbb7d1d50cd88
MD5 84804afe0c78ee7e1f684a22ef64df46
SHA1 5c2de5e0d5b79fb04da7bb5d6f522736098c640d
SHA512 785534c14c49a4968d4a49b0d0ecc5f6b3e8bb55261ff087c4ab1f27ff2b4f041ac46584856d5d1060af0bd5a641dcae7271790cc0f37a83f9cf13b67b69f117
SSDEEP 12288:4zUP2bEOlWzErxf9FiW7L7ELUkTERkWGvK2Zk04BHCze7nTm:4hbEOfx937yXwOVz6tna
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1144	Engage.exe.pif

Loads dropped DLL 1 IoCs

pid	Process
1716	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1752	tasklist.exe
1768	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
428	PING.EXE
864	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1144	Engage.exe.pif
1144	Engage.exe.pif
1144	Engage.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	tasklist.exe
Token: SeDebugPrivilege	1768	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1144	Engage.exe.pif
1144	Engage.exe.pif
1144	Engage.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1144	Engage.exe.pif
1144	Engage.exe.pif
1144	Engage.exe.pif

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2016	1212	file.exe	28
PID 1212 wrote to memory of 2016	1212	file.exe	28
PID 1212 wrote to memory of 2016	1212	file.exe	28
PID 1212 wrote to memory of 2016	1212	file.exe	28
PID 1212 wrote to memory of 988	1212	file.exe	30
PID 1212 wrote to memory of 988	1212	file.exe	30
PID 1212 wrote to memory of 988	1212	file.exe	30
PID 1212 wrote to memory of 988	1212	file.exe	30
PID 988 wrote to memory of 1716	988	cmd.exe	32
PID 988 wrote to memory of 1716	988	cmd.exe	32
PID 988 wrote to memory of 1716	988	cmd.exe	32
PID 988 wrote to memory of 1716	988	cmd.exe	32
PID 1716 wrote to memory of 1752	1716	cmd.exe	33
PID 1716 wrote to memory of 1752	1716	cmd.exe	33
PID 1716 wrote to memory of 1752	1716	cmd.exe	33
PID 1716 wrote to memory of 1752	1716	cmd.exe	33
PID 1716 wrote to memory of 1544	1716	cmd.exe	34
PID 1716 wrote to memory of 1544	1716	cmd.exe	34
PID 1716 wrote to memory of 1544	1716	cmd.exe	34
PID 1716 wrote to memory of 1544	1716	cmd.exe	34
PID 1716 wrote to memory of 1768	1716	cmd.exe	36
PID 1716 wrote to memory of 1768	1716	cmd.exe	36
PID 1716 wrote to memory of 1768	1716	cmd.exe	36
PID 1716 wrote to memory of 1768	1716	cmd.exe	36
PID 1716 wrote to memory of 468	1716	cmd.exe	37
PID 1716 wrote to memory of 468	1716	cmd.exe	37
PID 1716 wrote to memory of 468	1716	cmd.exe	37
PID 1716 wrote to memory of 468	1716	cmd.exe	37
PID 1716 wrote to memory of 1164	1716	cmd.exe	38
PID 1716 wrote to memory of 1164	1716	cmd.exe	38
PID 1716 wrote to memory of 1164	1716	cmd.exe	38
PID 1716 wrote to memory of 1164	1716	cmd.exe	38
PID 1716 wrote to memory of 1144	1716	cmd.exe	39
PID 1716 wrote to memory of 1144	1716	cmd.exe	39
PID 1716 wrote to memory of 1144	1716	cmd.exe	39
PID 1716 wrote to memory of 1144	1716	cmd.exe	39
PID 1716 wrote to memory of 428	1716	cmd.exe	40
PID 1716 wrote to memory of 428	1716	cmd.exe	40
PID 1716 wrote to memory of 428	1716	cmd.exe	40
PID 1716 wrote to memory of 428	1716	cmd.exe	40
PID 988 wrote to memory of 864	988	cmd.exe	41
PID 988 wrote to memory of 864	988	cmd.exe	41
PID 988 wrote to memory of 864	988	cmd.exe	41
PID 988 wrote to memory of 864	988	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\bitsadmin.exe
  bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Street.eps & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1768
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:468
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^CiEyGyHZjwhzv$" Pharmaceuticals.eps
      4⤵
      PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
      Engage.exe.pif z
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1144
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:428
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Engage.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Engage.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pharmaceuticals.eps

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pharmaceuticals.eps
Size 924KB
SHA256 be95b12e8496d96807678b1aff19b5743bb2a4d3b0f7f8b182d72cc6d010af6d
MD5 356bbe3005daf17b1df15999187f0626
SHA1 f937584ed3ca9d58fe0ea0cc72785d7abffdca4c
SHA512 dc2100df96bd90d8562cc6983b11fc0631a02b58edc786798502dbba228acfc979d3407a73f6e0040e878cfca249637a8a836cc96aca0a868852f6e0d354388b
SSDEEP 24576:OErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:O86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Regulations.eps

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Regulations.eps
Size 714KB
SHA256 248d524bd68f88bbca665bb61fb545f9ea5a87d25ea38f2bb309d1a6bf77ff51
MD5 c498ac2ec17f022f933540c028b1b8ff
SHA1 72fff639eb25cda9d27e740273303353dd38cb12
SHA512 f6aec2ed90925089d821c04356c700993a961d09a7fc987d65abbb13851360082bc89051081014f7ddd6de5fc3d75380065e1c93fa889e97ca2aeb4352160e42
SSDEEP 12288:7A/fFVB++D+5JLrg/mGJW0wt2ReJhQxKw:YfXB++D+5mzI0AO5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Street.eps

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Street.eps
Size 11KB
SHA256 7c4debb31b795c303d7c5864cab7113dc03ec3dd289cbf4871b2a00b9413adcc
MD5 a5ebe66feba15c4a346787d67c56b506
SHA1 3ca892231c6e435e49abfa9bf9036cfb7ad5f18d
SHA512 3ee6abe6b609a5b5aa70cb8ff7b5ea154f10af18373b4a7bb74e75a1aa91b67a888f6e65f5d2c3ee7614fffb75726f5693631c64d4bfdd902324589eacb56355
SSDEEP 192:49+KDTgOHAvZULoYT+jEO7E0xtzDzsfZ/ulhJFmz6gUFDyKlhJFRCUFDyToG2Ny+:49+nlxULoY+EqTxG+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Engage.exe.pif

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Engage.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2016-55-0x0000000076711000-0x0000000076713000-memory.dmp

Download