e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6.exe
Size

833KB
MD5

3b8114eb401e105315f51f83768682b7
SHA1

ed98532391475e1775aac69be89b5de4a3ad43b6
SHA256

e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6
SHA512

2c4e83c53203dfc470ef1cdacf4f2e74fc364e3bf54e04514fd42a09cf89df89fb74c3e107b74e89fb4e12389c19cf523f8783556bbbae642bce0cc43363e7c9
SSDEEP

24576:qHyaPeLrZ4b+kYWrdzM1hatTC+zC8OqGLvOtPi:ryyZYxDrdzgGzC0GLvOtP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CERTUTIL.exe

pid process

892 CERTUTIL.exe

pid	process
892	CERTUTIL.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6.exe

C:\Users\Admin\AppData\Local\Temp\e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6.exe
"C:\Users\Admin\AppData\Local\Temp\e83d5f4f7ab9c233008f0da7f7b3074684928b68b26d5a1295710b8fe3acc1b6.exe"
1⤵
- Adds Run key to start application
PID:1392

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CERTUTIL.exe
CERTUTIL -DECODE basim.TXT basitesting.EXE
2⤵
- Executes dropped EXE
PID:892

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\certutil.exe
Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
memory/1392-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download