Analysis
-
max time kernel
33s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:13
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
1.1MB
-
MD5
4fe8dcd05222282de480bdafea6aba1f
-
SHA1
759daa63a30ed49ffbf9a0193d84a1cdbe1222fd
-
SHA256
7d6cfc8c6d71c9ae06ec9774d5ccc0fc9243dc326e02fc4e383cfe2805bb51a5
-
SHA512
33cb600e6011bd0c1b4839943dc04e0811206f217a80f80368e00003ba67207bf9d1988502c84ec0b32291e4b8ab105be2c850899608fe23a18fea0664558ee2
-
SSDEEP
24576:8dxuLNNc/bZzuFVwtnXNff8VXhcjwJScM7N:ExuZNcFzuMtdkRcj+F6
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
file.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1272 powershell.exe 1272 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1272 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
file.execmd.execmd.exedescription pid process target process PID 1752 wrote to memory of 1728 1752 file.exe dllhost.exe PID 1752 wrote to memory of 1728 1752 file.exe dllhost.exe PID 1752 wrote to memory of 1728 1752 file.exe dllhost.exe PID 1752 wrote to memory of 1728 1752 file.exe dllhost.exe PID 1752 wrote to memory of 1980 1752 file.exe cmd.exe PID 1752 wrote to memory of 1980 1752 file.exe cmd.exe PID 1752 wrote to memory of 1980 1752 file.exe cmd.exe PID 1752 wrote to memory of 1980 1752 file.exe cmd.exe PID 1980 wrote to memory of 1600 1980 cmd.exe cmd.exe PID 1980 wrote to memory of 1600 1980 cmd.exe cmd.exe PID 1980 wrote to memory of 1600 1980 cmd.exe cmd.exe PID 1980 wrote to memory of 1600 1980 cmd.exe cmd.exe PID 1600 wrote to memory of 1272 1600 cmd.exe powershell.exe PID 1600 wrote to memory of 1272 1600 cmd.exe powershell.exe PID 1600 wrote to memory of 1272 1600 cmd.exe powershell.exe PID 1600 wrote to memory of 1272 1600 cmd.exe powershell.exe PID 1980 wrote to memory of 1376 1980 cmd.exe PING.EXE PID 1980 wrote to memory of 1376 1980 cmd.exe PING.EXE PID 1980 wrote to memory of 1376 1980 cmd.exe PING.EXE PID 1980 wrote to memory of 1376 1980 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost kajdkfjiwueriuiwjedkfmsnfvkajksdjfvopqeirjgfiowe2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Chaos.sldm & ping -n 5 localhost2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost3⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Chaos.sldmFilesize
11KB
MD5766cd31bc50af9191db198b9d9cbce21
SHA117e68a47d9b3047f45ee131939a26e61d40be489
SHA25611d2e04123587d79920d251e77d93ec63c31dbdd851fb83338ccae702abf4b9e
SHA512bc192b93130d20b3e977afefd396440d8d5b9f0810072ec7b49345d7fc37aef96e765637cbca1bd634b001dbc5ec962164032d6ebeb1635066e925c7f310294d
-
memory/1272-58-0x0000000000000000-mapping.dmp
-
memory/1272-59-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1272-60-0x0000000073DF0000-0x000000007439B000-memory.dmpFilesize
5.7MB
-
memory/1272-62-0x0000000073DF0000-0x000000007439B000-memory.dmpFilesize
5.7MB
-
memory/1376-61-0x0000000000000000-mapping.dmp
-
memory/1600-57-0x0000000000000000-mapping.dmp
-
memory/1728-54-0x0000000000000000-mapping.dmp
-
memory/1980-55-0x0000000000000000-mapping.dmp