dfd1bee3ed292173e7227059431ec28a4bb3f66eb21bc4553737d71715282669

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/12/2022, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server.exe
Size

806KB
MD5

c0db2c222008fee946d5b2ba4fb157b2
SHA1

d239a776d1a56423950b05a8dfa48baad49b4806
SHA256

dfd1bee3ed292173e7227059431ec28a4bb3f66eb21bc4553737d71715282669
SHA512

b6c7c9652b62db2fe92e810b71c88a463bd9a59adb4f58980a03ca57e1209f5cd94df278cfc54882ac718b7be0abbc338cc0cfec38c2874e107f37a99c6d4430
SSDEEP

12288:8Jy90Zzik406D2jedlhjpRftS7ibdoQzzIVlFFpmub4IjpRbQMbP6kz3:Oyoin06D2adrjpRocoQHIVjZNFQMbnT

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1980	certutil.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Adds Run key to start application
PID:2040
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\certutil.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\certutil.exe -decode Server.txt server.exe
  2⤵
  - Executes dropped EXE
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\certutil.exe

Filesize
1.6MB

MD5
e376b07aa887a6085ceae9be62ac9c37

SHA1
0545039e26171b2cdbe6039723b41676e2d3f796

SHA256
48922bb6498c432dd248cd337f4dcee0bfe77ee3ecbb1f8020d6db1f135e8e00

SHA512
c302584db2ab2593baad9cf52315f2d31407714db659ba1b2743512fe95faadf8325363a2bee2623caf5136c0f4697298f9feed8244ac439958a755121102152

Download Submit
memory/2040-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download