0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6

Analysis

max time kernel
22s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
Size

7.6MB
MD5

2f63d10c37c0166cb0ce2ebcbe724a15
SHA1

1f3b8c1806698d04d12698880f49c63ebe810d26
SHA256

0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6
SHA512

8d3935805d00f7118f631408ffeca241a5470740369f0274f59113c09ac78bd5ebbb2e8a69b82315b1709690de73eba3c7c3378256589056e15fb2e869d80e37
SSDEEP

196608:goomt3J786zqI31FLmV0FoGDUnGnW+bRxBP029Lu:bt3JIsd1940FopnGptxN0OL

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
596	303365~1.EXE

Loads dropped DLL 7 IoCs

pid	Process
2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
596	303365~1.EXE
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe
516	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
516	596	WerFault.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 2008 wrote to memory of 596	2008	0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe	28
PID 596 wrote to memory of 516	596	303365~1.EXE	29
PID 596 wrote to memory of 516	596	303365~1.EXE	29
PID 596 wrote to memory of 516	596	303365~1.EXE	29
PID 596 wrote to memory of 516	596	303365~1.EXE	29
PID 596 wrote to memory of 516	596	303365~1.EXE	29
PID 596 wrote to memory of 516	596	303365~1.EXE	29
PID 596 wrote to memory of 516	596	303365~1.EXE	29

C:\Users\Admin\AppData\Local\Temp\0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe
"C:\Users\Admin\AppData\Local\Temp\0e8756b487f0ad30e1ef88ca6416674471a4ce49fe97f392fc07700a32261fd6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 272
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\303365~1.EXE

Filesize
129KB

MD5
e6bc849721807658954ed15bc10f1860

SHA1
a0d7d952b0f5a012e0bbdee0ebae6d7fd996ac7f

SHA256
55045b6382b197528eb6591b15de5c7dd933bab84d0c2d4cc616aeda800af32e

SHA512
bb02eae101d989bde9e897dc0c7e598e218ffa9ec7fa9fbfbc9440beac3efe5aebccf4ea9bbd70864795d32d43e658cbe35b1d36b36c0a426678312b40e7d106

Download Submit
memory/596-62-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/596-67-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/2008-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download