b84ee931e8db117173345b24f6e25b1fd45e4179d0dc0c4057c07396df614d21

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-02-2023 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setuptorrent.exe
Size

659KB
MD5

75e0f3de613eb6ee9194115dc464966c
SHA1

d4fdea8d3b6370b74a8e3e5660db47f18fe423a1
SHA256

b84ee931e8db117173345b24f6e25b1fd45e4179d0dc0c4057c07396df614d21
SHA512

26090c3c943b3a5a60303281117c66e64c7799839605cc9f713f1ff625163f3b7ff1e22d8d00392a355146f57e90574656e69d54a92c722bf9ba2b54af899f08
SSDEEP

3072:PahKyd2n31qQ5DAoieXpw7vbKfShk8GMD2TKV435U9veML:PahOUoie5w7lf/9x

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

hospitalov.exe

pid process

1712 hospitalov.exe

pid	process
1712	hospitalov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setuptorrent.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setuptorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	setuptorrent.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hospitalov.exe

description pid process

Token: SeDebugPrivilege 1712 hospitalov.exe

description	pid	process
Token: SeDebugPrivilege	1712	hospitalov.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

setuptorrent.exe

description	pid	process	target process
PID 1064 wrote to memory of 1712	1064	setuptorrent.exe	hospitalov.exe
PID 1064 wrote to memory of 1712	1064	setuptorrent.exe	hospitalov.exe
PID 1064 wrote to memory of 1712	1064	setuptorrent.exe	hospitalov.exe
PID 1064 wrote to memory of 1712	1064	setuptorrent.exe	hospitalov.exe

C:\Users\Admin\AppData\Local\Temp\setuptorrent.exe
"C:\Users\Admin\AppData\Local\Temp\setuptorrent.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1064

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hospitalov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hospitalov.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hospitalov.exe
Filesize
362.6MB

MD5
12ff5de719a97afd4e9f9b7fca72a7dd

SHA1
5130172072c3fdf81782840d3c43633fa7fb9d49

SHA256
87ad342585334cd35b97a5e7549bf0564f9bc216ebaf145e8752fed27a1fa845

SHA512
f608f326a4a525561bf1b95d0414c254469cf35e9268d4614839827ed9290eb7fc89adccaee730d3dcc48bc0bbf3dd67b46b09ccd76456d1572b6f356814899a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hospitalov.exe
Filesize
362.6MB

MD5
12ff5de719a97afd4e9f9b7fca72a7dd

SHA1
5130172072c3fdf81782840d3c43633fa7fb9d49

SHA256
87ad342585334cd35b97a5e7549bf0564f9bc216ebaf145e8752fed27a1fa845

SHA512
f608f326a4a525561bf1b95d0414c254469cf35e9268d4614839827ed9290eb7fc89adccaee730d3dcc48bc0bbf3dd67b46b09ccd76456d1572b6f356814899a

Download Submit
memory/1712-60-0x0000000000E70000-0x0000000000EA0000-memory.dmp

Filesize
192KB

Download
memory/1712-61-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download
memory/1712-62-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download