Analysis
-
max time kernel
142s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 00:43
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
700KB
-
MD5
714253bb012b77ceb9ea902080498760
-
SHA1
d0464c5c39b42443de81fb1f78317ce794d76282
-
SHA256
80b7edf8fbf49ed29065f61146327b997a5da88e703421fb6f1c3cf63fdea02e
-
SHA512
5d0b6792aab9ce81bcd2e2dc06da76663f29662be3975efdb75f1154aaa49b36b32799fd882da06d9d98a247e77f16b90dcded93a43866127a2531b529c2bef2
-
SSDEEP
12288:2Mr7y904Q6qeczmnoVXANKCp2+9DMpcAbr2fnFfNf1cuudyO6aasQ2:lyHQ/ecVVXAcCGv2fFf9+um/6aa+
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
un413570.exepro5766.exepid process 1996 un413570.exe 1260 pro5766.exe -
Loads dropped DLL 5 IoCs
Processes:
setup.exeun413570.exepro5766.exepid process 2040 setup.exe 1996 un413570.exe 1996 un413570.exe 1996 un413570.exe 1260 pro5766.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
setup.exeun413570.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" setup.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce un413570.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un413570.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pro5766.exedescription pid process Token: SeDebugPrivilege 1260 pro5766.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
setup.exeun413570.exedescription pid process target process PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 2040 wrote to memory of 1996 2040 setup.exe un413570.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe PID 1996 wrote to memory of 1260 1996 un413570.exe pro5766.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un413570.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un413570.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un413570.exeFilesize
558KB
MD58a9e068a607086915df7be1c00a2b46b
SHA19f1b188a3608666898a2084d474129ee1d1f318c
SHA2566573925e79dc0e88ca47e9c2a36d703e3c5eafd739c2f3f2b046240e67ad659b
SHA5126d6fccd92156259144454fd5768c0cb0dc5c6007eba04008382399654ee621fba250631eb323c7a52f4580b2e29e46a25d5c7ab5db3eec7075de5dc14a6875e7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un413570.exeFilesize
558KB
MD58a9e068a607086915df7be1c00a2b46b
SHA19f1b188a3608666898a2084d474129ee1d1f318c
SHA2566573925e79dc0e88ca47e9c2a36d703e3c5eafd739c2f3f2b046240e67ad659b
SHA5126d6fccd92156259144454fd5768c0cb0dc5c6007eba04008382399654ee621fba250631eb323c7a52f4580b2e29e46a25d5c7ab5db3eec7075de5dc14a6875e7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeFilesize
307KB
MD5be252a8226b0618886d031a2fccb5a7b
SHA1527d39cf08e24f90cf23f6b638a1311d7f7597fa
SHA256658e7fb7cfb139b9aa8c51bbc30c0b1e0931cb403c2c3749070b6e77329cedd5
SHA512c6668c9f5ccf91d524b16699d8cc36e9922661345993a42ba745dc3a21adfbb968912c4441094481b6d897c8d8c13614a2e58c5710a73242365b8cfb316e2b85
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeFilesize
307KB
MD5be252a8226b0618886d031a2fccb5a7b
SHA1527d39cf08e24f90cf23f6b638a1311d7f7597fa
SHA256658e7fb7cfb139b9aa8c51bbc30c0b1e0931cb403c2c3749070b6e77329cedd5
SHA512c6668c9f5ccf91d524b16699d8cc36e9922661345993a42ba745dc3a21adfbb968912c4441094481b6d897c8d8c13614a2e58c5710a73242365b8cfb316e2b85
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeFilesize
307KB
MD5be252a8226b0618886d031a2fccb5a7b
SHA1527d39cf08e24f90cf23f6b638a1311d7f7597fa
SHA256658e7fb7cfb139b9aa8c51bbc30c0b1e0931cb403c2c3749070b6e77329cedd5
SHA512c6668c9f5ccf91d524b16699d8cc36e9922661345993a42ba745dc3a21adfbb968912c4441094481b6d897c8d8c13614a2e58c5710a73242365b8cfb316e2b85
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un413570.exeFilesize
558KB
MD58a9e068a607086915df7be1c00a2b46b
SHA19f1b188a3608666898a2084d474129ee1d1f318c
SHA2566573925e79dc0e88ca47e9c2a36d703e3c5eafd739c2f3f2b046240e67ad659b
SHA5126d6fccd92156259144454fd5768c0cb0dc5c6007eba04008382399654ee621fba250631eb323c7a52f4580b2e29e46a25d5c7ab5db3eec7075de5dc14a6875e7
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un413570.exeFilesize
558KB
MD58a9e068a607086915df7be1c00a2b46b
SHA19f1b188a3608666898a2084d474129ee1d1f318c
SHA2566573925e79dc0e88ca47e9c2a36d703e3c5eafd739c2f3f2b046240e67ad659b
SHA5126d6fccd92156259144454fd5768c0cb0dc5c6007eba04008382399654ee621fba250631eb323c7a52f4580b2e29e46a25d5c7ab5db3eec7075de5dc14a6875e7
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeFilesize
307KB
MD5be252a8226b0618886d031a2fccb5a7b
SHA1527d39cf08e24f90cf23f6b638a1311d7f7597fa
SHA256658e7fb7cfb139b9aa8c51bbc30c0b1e0931cb403c2c3749070b6e77329cedd5
SHA512c6668c9f5ccf91d524b16699d8cc36e9922661345993a42ba745dc3a21adfbb968912c4441094481b6d897c8d8c13614a2e58c5710a73242365b8cfb316e2b85
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeFilesize
307KB
MD5be252a8226b0618886d031a2fccb5a7b
SHA1527d39cf08e24f90cf23f6b638a1311d7f7597fa
SHA256658e7fb7cfb139b9aa8c51bbc30c0b1e0931cb403c2c3749070b6e77329cedd5
SHA512c6668c9f5ccf91d524b16699d8cc36e9922661345993a42ba745dc3a21adfbb968912c4441094481b6d897c8d8c13614a2e58c5710a73242365b8cfb316e2b85
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5766.exeFilesize
307KB
MD5be252a8226b0618886d031a2fccb5a7b
SHA1527d39cf08e24f90cf23f6b638a1311d7f7597fa
SHA256658e7fb7cfb139b9aa8c51bbc30c0b1e0931cb403c2c3749070b6e77329cedd5
SHA512c6668c9f5ccf91d524b16699d8cc36e9922661345993a42ba745dc3a21adfbb968912c4441094481b6d897c8d8c13614a2e58c5710a73242365b8cfb316e2b85
-
memory/1260-82-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-92-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-80-0x0000000000DD0000-0x0000000000DE8000-memory.dmpFilesize
96KB
-
memory/1260-81-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-78-0x00000000002E0000-0x000000000030D000-memory.dmpFilesize
180KB
-
memory/1260-84-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-86-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-88-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-90-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-79-0x0000000000790000-0x00000000007AA000-memory.dmpFilesize
104KB
-
memory/1260-94-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-96-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-98-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-100-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/1260-102-0x0000000000E20000-0x0000000000E60000-memory.dmpFilesize
256KB
-
memory/1260-103-0x0000000000E20000-0x0000000000E60000-memory.dmpFilesize
256KB
-
memory/1260-104-0x0000000000400000-0x000000000070F000-memory.dmpFilesize
3.1MB
-
memory/1260-105-0x0000000000E20000-0x0000000000E60000-memory.dmpFilesize
256KB