65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a

Analysis

max time kernel
30s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
Size

129KB
MD5

1efd85caf5731f48ff2cb1106de1e7e0
SHA1

9af53408c8910a78e007ed724eab37f580afc24f
SHA256

65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a
SHA512

cd2b55836223c1beffd7ea375a5a18b233c5259d4092ccf6dfce689d1aefbfa7feda398e28756e49cb9772bb59fb77c685b542f8059fa1dfc2572f4a1d5e7a3b
SSDEEP

3072:PgXdZt9P6D3XJ4lpgt5/KQwL4Wfd4yqRddQ5paMJqJQ24q5paMr:Pe34qlpgt5/KB7VMRdW5pLJJy5pLr

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2040	interplex.exe

Deletes itself 1 IoCs

pid	Process
1036	cmd.exe

Loads dropped DLL 7 IoCs

pid	Process
1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
2040	interplex.exe
2040	interplex.exe
2040	interplex.exe
1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\interplex = "C:\\Users\\Admin\\AppData\\Roaming\\interplex\\interplex.exe"	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\interplex.ini	interplex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1896	SCHTASKS.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	interplex.exe
2040	interplex.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 1896	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	27
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 2040	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	29
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32
PID 1504 wrote to memory of 1036	1504	65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe	32

C:\Users\Admin\AppData\Local\Temp\65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe
"C:\Users\Admin\AppData\Local\Temp\65ac5ef2d24bb4441485caa239e08212d8a1fcdcf8df5e171315ba9736e01a1a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /F /TN interplex /sc ONLOGON /TR "C:\Users\Admin\AppData\Roaming\interplex\interplex.exe" /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:1896
- C:\Users\Admin\AppData\Roaming\interplex\interplex.exe
  C:\Users\Admin\AppData\Roaming\interplex\interplex.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c \DelUS.bat
  2⤵
  - Deletes itself
  PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
264B

MD5
e23c673918c2c936da9176fab33cd2b5

SHA1
0edb9b514f0f7e1797900ab1b26b712c9d093a02

SHA256
f1db549428c4175a8c824b539cc799dd29e81966aaf097c1058039c3e44bea65

SHA512
683133a7471b748dcf455c7b82a7a6564eca4c2e433832e4afaf4b4325f5411c54acf5e05f546c11fe3e1ec4ed094f5b8e6a33c4bebc06ab409042d69383c53b

Download Submit
C:\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
C:\Users\Admin\AppData\Roaming\interplex\interplex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
\Users\Admin\AppData\Local\Temp\nst401E.tmp\SelfDelete.dll

Filesize
24KB

MD5
7bf1bd7661385621c7908e36958f582e

SHA1
43242d7731c097e95fb96753c8262609ff929410

SHA256
c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

SHA512
8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

Download Submit
\Users\Admin\AppData\Local\Temp\nst401E.tmp\nsExec.dll

Filesize
6KB

MD5
cdff6b8f9523b6ef9f20fb5f9e90f1a5

SHA1
b25f6e0a19b41ff0a12de8e98e3005bc119d34fa

SHA256
80b2740fb3a21ffab022a96ce6b420019072f8ef3a048fd9dea4a5b64498c0c8

SHA512
62585c6a6103aed10f9a79c016df8cb630c3e37715542b5f26aa1a910771540c9b323ddbba3329db0ecf524143f7a27b782e198ce944317f764be6b9d04b792e

Download Submit
\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
\Users\Admin\AppData\Roaming\interplex\InterPlex.exe

Filesize
386KB

MD5
e4da98a0f32c3c18abf062b3f62ed361

SHA1
4a3c54409345a31ab90cec95f69d81fb9fa06d17

SHA256
5c7a7f2edbcd5c69715c4f98f34063aabc394f716b1a77a6e1508a9ec4016e87

SHA512
a4fd5b462c7ddcb69b079da162352dca2d7d9ffafd4977e2cfbce6634eb9782803ea66581eb2aa06c76cdd5980c9dcbecf7344ccbed55cf03fae17f5805d0b0d

Download Submit
memory/1504-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads