c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/01/2023, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

decoded.exe
Size

1.3MB
MD5

2d48214132e5c4d808740e71ec5f6a7f
SHA1

f3c7534d9f139782006b5656ec0d229d8d9d356e
SHA256

c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca
SHA512

71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2
SSDEEP

24576:LMmDOoI0Acd30rkQS8nikHN+KNzPKqQRD2F2PcAFdiqP1t/qiSlJjKGY:LMelI0AA0rkQznikHnNyn62PVFLtiiSO

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	decoded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	decoded.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	powershell.exe
432	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1256	1260	decoded.exe	28
PID 1260 wrote to memory of 1256	1260	decoded.exe	28
PID 1260 wrote to memory of 1256	1260	decoded.exe	28
PID 1260 wrote to memory of 1256	1260	decoded.exe	28
PID 1260 wrote to memory of 2028	1260	decoded.exe	30
PID 1260 wrote to memory of 2028	1260	decoded.exe	30
PID 1260 wrote to memory of 2028	1260	decoded.exe	30
PID 1260 wrote to memory of 2028	1260	decoded.exe	30
PID 2028 wrote to memory of 276	2028	cmd.exe	32
PID 2028 wrote to memory of 276	2028	cmd.exe	32
PID 2028 wrote to memory of 276	2028	cmd.exe	32
PID 2028 wrote to memory of 276	2028	cmd.exe	32
PID 276 wrote to memory of 432	276	cmd.exe	33
PID 276 wrote to memory of 432	276	cmd.exe	33
PID 276 wrote to memory of 432	276	cmd.exe	33
PID 276 wrote to memory of 432	276	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\decoded.exe
"C:\Users\Admin\AppData\Local\Temp\decoded.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\nslookup.exe
  nslookup ashfdjkhgwiueghfruihwjkefwe
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell get-process avastui
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2

Filesize
11KB

MD5
cf13b620804b451200c2fc35d0955c1e

SHA1
0b9034ce408d6bdfc2d12a5f957361df1494b564

SHA256
968a4e2af5aa8c0ab95e65c08eb5a5ea03d921c9220def24675a676ff3f9fe76

SHA512
a4c73efd6ff723b9067c95258f02ee0570cf076a1d992456bfdccdd064e1771dde530d0dd046d2dad6185cb08eb4d641484f75b94b04f0dfd384bdd60fd22f26

Download Submit
memory/432-59-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/432-60-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/432-61-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download