b3abbc4d6ecd9a9774e53fca4639b59cd5e24fde9bf97742b046ece663eb2e41

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 797KB
Sample221104-ymjw9acdaq
SHA256 b3abbc4d6ecd9a9774e53fca4639b59cd5e24fde9bf97742b046ece663eb2e41
MD5 24d01773214d215ff114c720163073b5
SHA1 82a92b9a7adc212dbdd23d10d3bc6f17250a7b00
SHA512 3f88cf59fa3c9c707e5634b98999a2eb7add647574db5bb9d1d51427b20db299d62e81de04a5766afd97281638ce8696bcb23b94de136f9a280081ad28b14433
SSDEEP 12288:tzLUeDNHKkMVfxeiO28gxMRCSu4MwwkILw6kh3K9/5BkeV9irmJklE0TGGK:txjMVfsHDxIc3K9x+iiiJuEe
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2024	Finished.exe.pif

Loads dropped DLL 1 IoCs

pid	Process
592	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1780	tasklist.exe
1312	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1548	PING.EXE
1332	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2024	Finished.exe.pif
2024	Finished.exe.pif
2024	Finished.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	tasklist.exe
Token: SeDebugPrivilege	1312	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2024	Finished.exe.pif
2024	Finished.exe.pif
2024	Finished.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2024	Finished.exe.pif
2024	Finished.exe.pif
2024	Finished.exe.pif

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1352	2020	file.exe	26
PID 2020 wrote to memory of 1352	2020	file.exe	26
PID 2020 wrote to memory of 1352	2020	file.exe	26
PID 2020 wrote to memory of 1352	2020	file.exe	26
PID 2020 wrote to memory of 1588	2020	file.exe	27
PID 2020 wrote to memory of 1588	2020	file.exe	27
PID 2020 wrote to memory of 1588	2020	file.exe	27
PID 2020 wrote to memory of 1588	2020	file.exe	27
PID 1588 wrote to memory of 592	1588	cmd.exe	29
PID 1588 wrote to memory of 592	1588	cmd.exe	29
PID 1588 wrote to memory of 592	1588	cmd.exe	29
PID 1588 wrote to memory of 592	1588	cmd.exe	29
PID 592 wrote to memory of 1780	592	cmd.exe	30
PID 592 wrote to memory of 1780	592	cmd.exe	30
PID 592 wrote to memory of 1780	592	cmd.exe	30
PID 592 wrote to memory of 1780	592	cmd.exe	30
PID 592 wrote to memory of 1680	592	cmd.exe	31
PID 592 wrote to memory of 1680	592	cmd.exe	31
PID 592 wrote to memory of 1680	592	cmd.exe	31
PID 592 wrote to memory of 1680	592	cmd.exe	31
PID 592 wrote to memory of 1312	592	cmd.exe	33
PID 592 wrote to memory of 1312	592	cmd.exe	33
PID 592 wrote to memory of 1312	592	cmd.exe	33
PID 592 wrote to memory of 1312	592	cmd.exe	33
PID 592 wrote to memory of 1268	592	cmd.exe	34
PID 592 wrote to memory of 1268	592	cmd.exe	34
PID 592 wrote to memory of 1268	592	cmd.exe	34
PID 592 wrote to memory of 1268	592	cmd.exe	34
PID 592 wrote to memory of 1868	592	cmd.exe	35
PID 592 wrote to memory of 1868	592	cmd.exe	35
PID 592 wrote to memory of 1868	592	cmd.exe	35
PID 592 wrote to memory of 1868	592	cmd.exe	35
PID 592 wrote to memory of 2024	592	cmd.exe	36
PID 592 wrote to memory of 2024	592	cmd.exe	36
PID 592 wrote to memory of 2024	592	cmd.exe	36
PID 592 wrote to memory of 2024	592	cmd.exe	36
PID 592 wrote to memory of 1332	592	cmd.exe	37
PID 592 wrote to memory of 1332	592	cmd.exe	37
PID 592 wrote to memory of 1332	592	cmd.exe	37
PID 592 wrote to memory of 1332	592	cmd.exe	37
PID 1588 wrote to memory of 1548	1588	cmd.exe	39
PID 1588 wrote to memory of 1548	1588	cmd.exe	39
PID 1588 wrote to memory of 1548	1588	cmd.exe	39
PID 1588 wrote to memory of 1548	1588	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\tapiunattend.exe
  tapiunattend.exe
  2⤵
  PID:1352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Supporting.aspx & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1312
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:1268
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^nuGgmUwoRXm$" Jp.aspx
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
      Finished.exe.pif T
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2024
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:1332
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Finished.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finished.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Him.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Him.aspx
Size 713KB
SHA256 99badb2591955cb46fb72b4ff2ffa7611d31d0abbbaa5613fec80c900307fbd4
MD5 8322af58d0e58367766896afdab5524a
SHA1 7a22d1a1ce77205d75ef9ce52d2df34dc8868a4b
SHA512 3889ec99ce059302b0351f5babe9802fd8d2edef001dc4cd87fb92a5e0a4a848dad57fcff66393bae2fdaef7dde18149f22e48aa0b1221905f5190680dbbfd1a
SSDEEP 6144:Z1F4XwlLQkpuufwxAjj2RKZgRrOTEMKJ5/gGSerHN69t0tutIrePEj2VREm8S6Z3:Z1d6AfQDxH9/gGSWN69t0tutjNEmOXN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jp.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jp.aspx
Size 925KB
SHA256 26fde5b82ae2dc28a3f0e382626e72ea2dbd7858ed99aa132a629b39e445981f
MD5 e902b73edbcc01363e0335533c6ebf8f
SHA1 a48839a6eaf1cf8db2dc1592666f071b7de1d4ae
SHA512 ba1a0d139b0c286fa30ce92878f662c0e6feafeb0173be11e2f068738ab235f7e11bb8bcc1284c1be2358420d53da72130ffe19bb2debed5a1575e98944e4def
SSDEEP 24576:NYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:N37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Supporting.aspx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Supporting.aspx
Size 12KB
SHA256 6f36aab1348b4235b403a7cee5ef59f879bf54b916f1b8ff5f3696327dbc973d
MD5 86901ca49bae85011c7767681734a99a
SHA1 198f6967241a1d403924b4c03a6d11b98d7464fa
SHA512 049a327660139da57a71ecae192591c262d86c592144a4aabaaaac47b9292ccaa72ac3f41cbeb78725ea4668fa410d348a6fc4eae136a657498191b83c265189
SSDEEP 192:Kb0XMBtY1947lTv7sv8QtUvM8/BiBBn4HOAGRFq5t7UsOAGQqR7U3BclE:KYYtY3lU5Bi3nBfXQtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finished.exe.pif

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Finished.exe.pif
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2024-69-0x0000000075451000-0x0000000075453000-memory.dmp

Download