Analysis
- max time kernel
29s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
06/12/2022, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
- Size 249KB
- Sample221206-p686taae47
- SHA256 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2
- MD5 4011c591946de4c19898e1c5e54f0aa4
- SHA1 5210204058d35f1c53cd278eee34a5b6f327e9df
- SHA512 b9a6e72c0e3948c8f8e585390857d4e9eeedac3d13bb3e6b459f232abac0ff5b3818836c4f8417dbbff2d032e276c08fca3be054b07dd0cd605f3d5645e311a5
- SSDEEP 6144:eWq8/eR6p0yN90QE1BRYU+d0rwqR6M3hIPk:L/eBy905RP+d0Eq48N
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 920 15911.exe 1232 15911.exe - Loads dropped DLL 5 IoCs
pid Process 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 920 15911.exe 920 15911.exe 1232 15911.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 920 set thread context of 1232 920 15911.exe 28 PID 920 set thread context of 0 920 15911.exe PID 920 set thread context of 0 920 15911.exe PID 920 set thread context of 0 920 15911.exe PID 920 set thread context of 0 920 15911.exe PID 920 set thread context of 0 920 15911.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1232 15911.exe 1232 15911.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 920 15911.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 912 wrote to memory of 920 912 b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe 27 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 1232 920 15911.exe 28 PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 920 wrote to memory of 0 920 15911.exe PID 1232 wrote to memory of 1208 1232 15911.exe 15 PID 1232 wrote to memory of 1208 1232 15911.exe 15 PID 1232 wrote to memory of 1208 1232 15911.exe 15 PID 1232 wrote to memory of 1208 1232 15911.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe"C:\Users\Admin\AppData\Local\Temp\b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1232
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
- Size 364KB
- SHA256 de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb
- MD5 a4a0b5864d177694528dc6fdd80b091d
- SHA1 e00a83525b26cfeb8fee5e9dc20aceef4b809458
- SHA512 e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955
- SSDEEP 3072:Gb30a/qJ3PyFCHhAnk27xhItLHKgFnwr4:GKWg5Z
- MD5 SHA1 SHA512 SSDEEP