c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb

Analysis

max time kernel
94s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe
Size

100KB
MD5

1fe251ce38f5d224a32c11363b5ec0df
SHA1

5300c08cebdd3aef4b311358ef45b9dd81498ebd
SHA256

c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb
SHA512

a14492ad2a55717729c191e3c67d0d7b0c7431a0fc89c9c8c3673f227eb87d5dba7e1770e882841e0007fbe4547e520b692a74ef88448a821b6692a467518676
SSDEEP

3072:DGu9BlfzWIbXWm+w0JPU5CTkHlT1l1O9TEF:D/0uo7KHlJb

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
396	myspace.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 396	5080	c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe	81
PID 5080 wrote to memory of 396	5080	c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe	81
PID 5080 wrote to memory of 396	5080	c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe	81

C:\Users\Admin\AppData\Local\Temp\c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe
"C:\Users\Admin\AppData\Local\Temp\c1f2bf4d9274c2b003dc3b18a0033d6911df7ddc1eb1671697e1e6113cd330bb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\myspace.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\myspace.exe
  2⤵
  - Executes dropped EXE
  PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\myspace.exe

Filesize
55KB

MD5
f4e91307aaed1494cc03d9aaa03b04ec

SHA1
8e27c15a0ca0115db2b33fd33100bc82098cdaf6

SHA256
e8b0352753168b85453f016775d080d6aa18775e05164a199f8f8b53557149ba

SHA512
3e948cf51c99314fc38d8b31c8046dc544884eddddd1b16632272a25b99725cb821ab7c47da6584d52ee0dc3f8728d20c47963cea6e9be8708be580a640d37c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\myspace.exe

Filesize
55KB

MD5
f4e91307aaed1494cc03d9aaa03b04ec

SHA1
8e27c15a0ca0115db2b33fd33100bc82098cdaf6

SHA256
e8b0352753168b85453f016775d080d6aa18775e05164a199f8f8b53557149ba

SHA512
3e948cf51c99314fc38d8b31c8046dc544884eddddd1b16632272a25b99725cb821ab7c47da6584d52ee0dc3f8728d20c47963cea6e9be8708be580a640d37c5

Download Submit