18055486aef1f706a69134be283fffdad9c49f5ffecda5d869e74c2ae882cd6c

Analysis

max time kernel
144s
max time network
158s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2d67add9931542f27af310c5f6684ff.exe
Size 2.1MB
Sample221207-pkg57seh35
SHA256 18055486aef1f706a69134be283fffdad9c49f5ffecda5d869e74c2ae882cd6c
MD5 a2d67add9931542f27af310c5f6684ff
SHA1 e73316f2e32bad7df56c5e975c8aae13efc3aa84
SHA512 ccc9b973c0daf73ec6b33447d18c7153f7690e249a7e243b8923709a0149e30ad979563f8be06472e39b8f2cfca6bd30d858965994da174af58789d9ed937832
SSDEEP 49152:I47W2+irPkgTByJA6QDxX4IEV+jtCpLE+8TxQE:Fa2nrsgTBdDREgjMpLp2xQE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1220	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1348	cmd.exe
1220	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a2d67add9931542f27af310c5f6684ff.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a2d67add9931542f27af310c5f6684ff.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	conhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	conhost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe
1220	conhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 860 wrote to memory of 1348	860	a2d67add9931542f27af310c5f6684ff.exe	27
PID 1348 wrote to memory of 1220	1348	cmd.exe	29
PID 1348 wrote to memory of 1220	1348	cmd.exe	29
PID 1348 wrote to memory of 1220	1348	cmd.exe	29
PID 1348 wrote to memory of 1220	1348	cmd.exe	29
PID 1348 wrote to memory of 1220	1348	cmd.exe	29
PID 1348 wrote to memory of 1220	1348	cmd.exe	29
PID 1348 wrote to memory of 1220	1348	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\a2d67add9931542f27af310c5f6684ff.exe
"C:\Users\Admin\AppData\Local\Temp\a2d67add9931542f27af310c5f6684ff.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c biffdumguwh.bat 742677524
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lccpyntjdkr.dat 742677524
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biffdumguwh.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\biffdumguwh.bat
Size 111B
SHA256 ad01d09c709526a18f4578ab8ef943d4cc8ee3e051712bf7536c79bf9b5b74a4
MD5 d106717c3e5aeea2e697e02e43a34c74
SHA1 06f4c497b1106f5ebbf7cedaf01c60cc337aa025
SHA512 8524cd853f3d68fa4cc66f7f490df894aa0d4e0ed1edde91383e2781051689f4779309ed3c999b7d4a7b6e8bda07fd6985dba00563b0a158f89bdf6929250528
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 f0280e1f5c2568e5fda9f911ab8341b47914a21d30f854136299f510dc843816
MD5 2890f1847d5d5f8f0e0c036eb0e9d58c
SHA1 656306727fb15c4c43c40b57eb98c016fd1ec6fd
SHA512 233d5d07e98dc55c2d4d992f4d86b3bd19850db871e514569fc28e39b4cf8552f2225e38527341f85eb50a357b7781924185de163e540f270e3157545be6bda6
SSDEEP 49152:kOTrG8+oMMZlxDffaWDfjgkTkOky11LAIElzI+7pMf9VxEc1+koC98lYMhhTQE6b:k39oM2DtjgkTvky11LAIuccgRyIVsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 f0280e1f5c2568e5fda9f911ab8341b47914a21d30f854136299f510dc843816
MD5 2890f1847d5d5f8f0e0c036eb0e9d58c
SHA1 656306727fb15c4c43c40b57eb98c016fd1ec6fd
SHA512 233d5d07e98dc55c2d4d992f4d86b3bd19850db871e514569fc28e39b4cf8552f2225e38527341f85eb50a357b7781924185de163e540f270e3157545be6bda6
SSDEEP 49152:kOTrG8+oMMZlxDffaWDfjgkTkOky11LAIElzI+7pMf9VxEc1+koC98lYMhhTQE6b:k39oM2DtjgkTvky11LAIuccgRyIVsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

euldiipf.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\euldiipf.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

euldiipf.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\euldiipf.dat.1
Size 2B
SHA256 ccc8d02c8169fdaeaaa52f9c74dfa3e1238ac5d0e89bc35223d423517f8e2b2d
MD5 873e009ecf0ccec19b3570baf5e70305
SHA1 d68e129e2ac27d06de80d1b16c1c4c4f589523f1
SHA512 4e483d49046751b02d209650cd1d82df15a3a99a41036c60fb4a1318df61fb7b51236442e5ad1e3116249737721e9aa6717becba1b2ef1ddc4fece5fca756f7e
MD5 SHA1 SHA512

Submit Download

euldiipf.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\euldiipf.dat.2
Size 5.2MB
SHA256 9c237d3f2dc2ed38023218646ff45abf74a713e6e6f68fe228fa55b349ec967a
MD5 fa8bb648e6cf21beea85c7f6e1e8e67a
SHA1 11367d7e007a76ed03da835906e8cb726a9b1228
SHA512 1f592efe8e78ebb39c86c0eb344bc6a146395ac0aa9690bba28d86c9c591cb7ecfbd1364ba54f14d9b48d3bf3efd3985c0e1e3c519bf3ae0be30a2bf770a3234
SSDEEP 49152:dOTrG8+oMMZlxDffaWDfjgkTkOky11LAIElzI+7pMf9VxEc1+koC98lYMhhTQE6b:d39oM2DtjgkTvky11LAIuccgRyIVsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

lccpyntjdkr.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lccpyntjdkr.dat
Size 373KB
SHA256 c790ed074deeb26ebbe6e37fafa9b42ea132f77583cca58f3cc5bbd18a2537aa
MD5 0ca2c517cbc0e3ef4036cd5858da8cee
SHA1 98329cbc5c401a25078c8ea88acb761f3f1cd751
SHA512 1c4f1c644f9901f335912f574e38c2ac1f71f4967843ec2679f35183b75044855baaa77e3f7f98163aeb458605f8446f8e82178f90d7393e31879111d47e2b3b
SSDEEP 6144:RE9/ppTb9XyH4eIZBIxPyQ1s3VuCL4ThEteDXUvMIlA+AdLwcXC+jn+:m9LdXyYeGBIxPh1muCL4ThEMmMOAhXCt
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 f0280e1f5c2568e5fda9f911ab8341b47914a21d30f854136299f510dc843816
MD5 2890f1847d5d5f8f0e0c036eb0e9d58c
SHA1 656306727fb15c4c43c40b57eb98c016fd1ec6fd
SHA512 233d5d07e98dc55c2d4d992f4d86b3bd19850db871e514569fc28e39b4cf8552f2225e38527341f85eb50a357b7781924185de163e540f270e3157545be6bda6
SSDEEP 49152:kOTrG8+oMMZlxDffaWDfjgkTkOky11LAIElzI+7pMf9VxEc1+koC98lYMhhTQE6b:k39oM2DtjgkTvky11LAIuccgRyIVsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 f0280e1f5c2568e5fda9f911ab8341b47914a21d30f854136299f510dc843816
MD5 2890f1847d5d5f8f0e0c036eb0e9d58c
SHA1 656306727fb15c4c43c40b57eb98c016fd1ec6fd
SHA512 233d5d07e98dc55c2d4d992f4d86b3bd19850db871e514569fc28e39b4cf8552f2225e38527341f85eb50a357b7781924185de163e540f270e3157545be6bda6
SSDEEP 49152:kOTrG8+oMMZlxDffaWDfjgkTkOky11LAIElzI+7pMf9VxEc1+koC98lYMhhTQE6b:k39oM2DtjgkTvky11LAIuccgRyIVsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-54-0x0000000075071000-0x0000000075073000-memory.dmp

Download