a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
Size

2.0MB
MD5

5d7be0e0f5c6010bb2d73d774010e0df
SHA1

b848c596ece988bfb0435ff667dc394c17f70300
SHA256

a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190
SHA512

65446afd574dd93a9a3e1390b31edfb871f7f5684b07e8488375225870e1da37e58a29ad2a561f169df6b1dc215bd35fd86e2b9c4cca57f22628a9ab10efce29
SSDEEP

49152:U6hv9W/ug/057LLqs3YvNa6khzoEPyKi6:U096s5jqEYF5khcEP1F

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3084	303365~1.EXE
2356	ENSETU~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3084	2548	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	81
PID 2548 wrote to memory of 3084	2548	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	81
PID 2548 wrote to memory of 3084	2548	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	81
PID 2548 wrote to memory of 2356	2548	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	82
PID 2548 wrote to memory of 2356	2548	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	82
PID 2548 wrote to memory of 2356	2548	a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe	82

C:\Users\Admin\AppData\Local\Temp\a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe
"C:\Users\Admin\AppData\Local\Temp\a0a8aa0aecded161bd245f708f33487b671573397776c07cbd8f1481b6152190.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ENSETU~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ENSETU~1.EXE
  2⤵
  - Executes dropped EXE
  PID:2356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
186KB

MD5
8c06d94a550366d87a5ca3bdedc334f6

SHA1
c12d68e09c44615ffe1a09d41736071ca0ea7b75

SHA256
1affe5606ce369b4a895b126f73760930c899bd47aea2e49a75e8037e23d1691

SHA512
6c4f60397ee499bb7e60f6722a7e0e24c6a42a0c1fe597edbdbabce3c7e01542fed8e0e12a6aef729b6ece6b88b22761e98df1ac957d56244cf9e2877307f08a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ENSETU~1.EXE

Filesize
1.8MB

MD5
f223889f4c948e53ee94397431501ddd

SHA1
bbca470784715d84d0ecf47a6a0d068596afe53d

SHA256
8591e1c037323622db0202fb0b936f74194ac70930ac7729f6efc708d05f5f7f

SHA512
485417d3207641cfd484771e6ae21f51fc5156ba00c7eb308c83a29eb3794d22d87ef1931dab5e94a728a2e91304928e45fa0b7cde2d2e80c8337a45aa836364

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ENSETU~1.EXE

Filesize
1.8MB

MD5
f223889f4c948e53ee94397431501ddd

SHA1
bbca470784715d84d0ecf47a6a0d068596afe53d

SHA256
8591e1c037323622db0202fb0b936f74194ac70930ac7729f6efc708d05f5f7f

SHA512
485417d3207641cfd484771e6ae21f51fc5156ba00c7eb308c83a29eb3794d22d87ef1931dab5e94a728a2e91304928e45fa0b7cde2d2e80c8337a45aa836364

Download Submit
memory/3084-135-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3084-136-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download