a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
Size

1.5MB
MD5

87150f1823d978c6f64292f49a7fc476
SHA1

b83926e4f0799afc96e83e7521cc4b8fd266773b
SHA256

a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076
SHA512

91206bc6380145cbdf8bd361b83195a2109f1c4ce749566c852cf11c0557769e6cf83b800ffd4b220ccdde95908046c2713b901c96568a80cae5ee6a890cc26c
SSDEEP

24576:yy4e+kpDN5NoJndLG4mnAYYzWne8cJ3Jf3Zp1hXYAKhb/tKXH4JWZ9ZXm:ZTDL6bqYzWdcJ3tZpGztOsWnZ

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1948	Rundll32.exe
1660	Rundll32.exe
1552	wrar380tr.exe

Loads dropped DLL 4 IoCs

pid	Process
2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
1948	Rundll32.exe
2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 1660	1948	Rundll32.exe	29

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	wrar380tr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1948	Rundll32.exe
1552	wrar380tr.exe
1552	wrar380tr.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 2000 wrote to memory of 1948	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	28
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 1948 wrote to memory of 1660	1948	Rundll32.exe	29
PID 2000 wrote to memory of 1552	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	30
PID 2000 wrote to memory of 1552	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	30
PID 2000 wrote to memory of 1552	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	30
PID 2000 wrote to memory of 1552	2000	a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe	30

C:\Users\Admin\AppData\Local\Temp\a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe
"C:\Users\Admin\AppData\Local\Temp\a3c399845e33b7ea1ece84ecdbe3724ef069ff2429cbbd3c292b5dfb1a815076.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe
    3⤵
    - Executes dropped EXE
    PID:1660
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe

Filesize
1.4MB

MD5
4a285ba4158202cc3a064cfe9f1f2b45

SHA1
ccd3ae603ad782a6de5c40b31dd73fd51646725d

SHA256
56dbbe6eedb45676dde627587576afe27b7aab9c99d5f2a1a33fb321ea8d5348

SHA512
baf59787e04c0688320d451e4b2bc707c3890176c0f3dcd2089d453886362a55bc8ba697ef45e529022d2cf138a91092d7640ba1be10553e70eada21250c2da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe

Filesize
1.4MB

MD5
4a285ba4158202cc3a064cfe9f1f2b45

SHA1
ccd3ae603ad782a6de5c40b31dd73fd51646725d

SHA256
56dbbe6eedb45676dde627587576afe27b7aab9c99d5f2a1a33fb321ea8d5348

SHA512
baf59787e04c0688320d451e4b2bc707c3890176c0f3dcd2089d453886362a55bc8ba697ef45e529022d2cf138a91092d7640ba1be10553e70eada21250c2da6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rundll32.exe

Filesize
108KB

MD5
9539a5e3098acdcc2f92157497cd6bbc

SHA1
03cf7395df74dc52b830ec07117aac9893e774cf

SHA256
679c18b829ea991a846d141a50068f40ecbde3e8307e26d97b97f04782b6c493

SHA512
9acd6788660813e2c5d46a00ae6c770341404ff51f025a345babd24aa616c0748726fd03265d11f745dd1ee467bd10a54b18b66f8e5a340056867986098ac1b1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\wrar380tr.exe

Filesize
1.4MB

MD5
4a285ba4158202cc3a064cfe9f1f2b45

SHA1
ccd3ae603ad782a6de5c40b31dd73fd51646725d

SHA256
56dbbe6eedb45676dde627587576afe27b7aab9c99d5f2a1a33fb321ea8d5348

SHA512
baf59787e04c0688320d451e4b2bc707c3890176c0f3dcd2089d453886362a55bc8ba697ef45e529022d2cf138a91092d7640ba1be10553e70eada21250c2da6

Download Submit
memory/1660-64-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1660-67-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1660-70-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1660-65-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1660-63-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1948-59-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads