71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf

Analysis

max time kernel
192s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe
Size

403KB
MD5

dfff6ff153d98b529c9059b7603ecf4f
SHA1

f89bfaad398f96db91f6b74fe97d524bf4f5e9e8
SHA256

71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf
SHA512

1b721fec23240dc0a3c6b4a809f82b5b5cc3d7721c3b351c2861a50cabcbd1e2c68de071fc47b567d25de325e00858c007ce7b4c0bb4eddca36c50e3b94db30f
SSDEEP

6144:lQGCIImwp0yN90QEjNEepgskfLRVPXqHROM/0fsuBGHwN:lQiy90AepPsRVCHROBUCGQN

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

sexy.exesexy.exe

pid process

2620 sexy.exe
3036 sexy.exe

pid	process
2620	sexy.exe
3036	sexy.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

672 2620 WerFault.exe sexy.exe
2880 3036 WerFault.exe sexy.exe

pid	pid_target	process	target process
672	2620	WerFault.exe	sexy.exe
2880	3036	WerFault.exe	sexy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe

description	pid	process	target process
PID 3332 wrote to memory of 2620	3332	71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe	sexy.exe
PID 3332 wrote to memory of 2620	3332	71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe	sexy.exe
PID 3332 wrote to memory of 3036	3332	71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe	sexy.exe
PID 3332 wrote to memory of 3036	3332	71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe	sexy.exe

C:\Users\Admin\AppData\Local\Temp\71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe
"C:\Users\Admin\AppData\Local\Temp\71983ed535fa3bffecc67c8cff2dd16718287959be6075deb7d059e9f321fabf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3332

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
2⤵
- Executes dropped EXE
PID:2620

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2620 -s 1032
3⤵
- Program crash
PID:672

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
2⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3036 -s 1032
3⤵
- Program crash
PID:2880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 192 -p 2620 -ip 2620
1⤵
PID:4472

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 3036 -ip 3036
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
Filesize
110KB

MD5
719f3fdb840bf5a9b832a8ecee4c3c7d

SHA1
ca70746c34fc823e96155dcebd7659eb83995b89

SHA256
9069a5af8af8d48a9378a97ff7e0589bb0bef924bbed3fa9f1fe01ee87cad923

SHA512
078261f0c930cb2aa0da5b8d394af1ea91c44c88cdb3f2d40716dbb0f062993100f6a442382f99f5d454bd43e8a91b4b4aec1af8ea0bf5de88db47211881a900

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
Filesize
110KB

MD5
719f3fdb840bf5a9b832a8ecee4c3c7d

SHA1
ca70746c34fc823e96155dcebd7659eb83995b89

SHA256
9069a5af8af8d48a9378a97ff7e0589bb0bef924bbed3fa9f1fe01ee87cad923

SHA512
078261f0c930cb2aa0da5b8d394af1ea91c44c88cdb3f2d40716dbb0f062993100f6a442382f99f5d454bd43e8a91b4b4aec1af8ea0bf5de88db47211881a900

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sexy.exe
Filesize
110KB

MD5
719f3fdb840bf5a9b832a8ecee4c3c7d

SHA1
ca70746c34fc823e96155dcebd7659eb83995b89

SHA256
9069a5af8af8d48a9378a97ff7e0589bb0bef924bbed3fa9f1fe01ee87cad923

SHA512
078261f0c930cb2aa0da5b8d394af1ea91c44c88cdb3f2d40716dbb0f062993100f6a442382f99f5d454bd43e8a91b4b4aec1af8ea0bf5de88db47211881a900

Download Submit
memory/2620-132-0x0000000000000000-mapping.dmp

Download
memory/2620-135-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/2620-136-0x00007FFECD080000-0x00007FFECDB41000-memory.dmp

Filesize
10.8MB

Download
memory/2620-137-0x00007FFECD080000-0x00007FFECDB41000-memory.dmp

Filesize
10.8MB

Download
memory/2620-138-0x00007FFECD080000-0x00007FFECDB41000-memory.dmp

Filesize
10.8MB

Download
memory/3036-139-0x0000000000000000-mapping.dmp

Download
memory/3036-141-0x00007FFECD130000-0x00007FFECDBF1000-memory.dmp

Filesize
10.8MB

Download
memory/3036-142-0x00007FFECD130000-0x00007FFECDBF1000-memory.dmp

Filesize
10.8MB

Download