649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a

Resubmissions

15-11-2024 18:05

241115-wpjcdsxrdy 10

11-11-2024 21:40

241111-1h6xbsxcql 10

03-12-2022 17:54

221203-wg4ncscc33 10

Analysis

max time kernel
154s
max time network
184s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe
Size

215KB
MD5

926677dc69319999351c0771c03ca302
SHA1

0d36a4435c234015d7c3207762b08c1924272753
SHA256

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a
SHA512

3e34fb409fec7dbe39a6f3e19a0db3f97ac944dfa0c0ffecc00d5510285fe99f42ba80cb6a910f834cb7ba47b487329dc1facc168ce970de34a8e2a32c5abe42
SSDEEP

1536:8I47GyTGCwiSnmQUt0LB18rs5gc3H2KrmswOOF+xcYPit0AQ:8vGyYiSDnt18w5X3HrrmsQMxDqqAQ

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SETUP_~1.EXE

pid process

1520 SETUP_~1.EXE

pid	process
1520	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SETUP_~1.EXE

description pid process

Token: SeDebugPrivilege 1520 SETUP_~1.EXE

description	pid	process
Token: SeDebugPrivilege	1520	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

description	pid	process	target process
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE
PID 1092 wrote to memory of 1520	1092	34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe	SETUP_~1.EXE

C:\Users\Admin\AppData\Local\Temp\34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe
"C:\Users\Admin\AppData\Local\Temp\34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
6d08fd7ee7d279585077bff3b77c9cf1

SHA1
09918a40856f17990378fcf280d3ce399d1bbdde

SHA256
d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a

SHA512
9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
6d08fd7ee7d279585077bff3b77c9cf1

SHA1
09918a40856f17990378fcf280d3ce399d1bbdde

SHA256
d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a

SHA512
9673687f67aecefaeeb24104cea85632a89ca4533fe668a14a99cc05ff2fd0e399b8ff62c1716f933884bc160639ca9245fcfaf70dbc32cd8180e55808cf7e01

Download Submit
memory/1520-54-0x0000000000000000-mapping.dmp

Download
memory/1520-57-0x0000000001380000-0x0000000001388000-memory.dmp

Filesize
32KB

Download
memory/1520-58-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download