Analysis
-
max time kernel
338s -
max time network
411s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 20:36
Static task
static1
Behavioral task
behavioral1
Sample
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe
Resource
win10v2004-20230221-en
General
-
Target
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe
-
Size
1.5MB
-
MD5
2e667dec3dea82de02ed6b0d947672d4
-
SHA1
025e2c59034345a5c86acc8b04f70c0eaf82ea56
-
SHA256
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1
-
SHA512
2deb511ba513f4ca97639eed541ef73045fcdbb25b3b2ee51904b7d07c5aaec2f87cf38191ace33975e2bb9e2452a6eb92dedb2d4e4f9c5521a43bb9f920661a
-
SSDEEP
24576:wyUhKIa1M21gfKXfxEXf4tuDZy7tw+QiOrekk8EOBobGV8fg1uMKPeGOxmjys3kC:3UKIOAK+XQtYo7trQiOreYPoqVyg8MKS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
61254245.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 61254245.exe -
Executes dropped EXE 6 IoCs
Processes:
za705935.exeza732301.exeza987971.exe61254245.exe1.exeu96726410.exepid process 3280 za705935.exe 1796 za732301.exe 4660 za987971.exe 3748 61254245.exe 868 1.exe 1004 u96726410.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exeza705935.exeza732301.exeza987971.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za705935.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za705935.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za732301.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za732301.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za987971.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" za987971.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1.exepid process 868 1.exe 868 1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
61254245.exe1.exedescription pid process Token: SeDebugPrivilege 3748 61254245.exe Token: SeDebugPrivilege 868 1.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exeza705935.exeza732301.exeza987971.exe61254245.exedescription pid process target process PID 1404 wrote to memory of 3280 1404 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe za705935.exe PID 1404 wrote to memory of 3280 1404 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe za705935.exe PID 1404 wrote to memory of 3280 1404 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe za705935.exe PID 3280 wrote to memory of 1796 3280 za705935.exe za732301.exe PID 3280 wrote to memory of 1796 3280 za705935.exe za732301.exe PID 3280 wrote to memory of 1796 3280 za705935.exe za732301.exe PID 1796 wrote to memory of 4660 1796 za732301.exe za987971.exe PID 1796 wrote to memory of 4660 1796 za732301.exe za987971.exe PID 1796 wrote to memory of 4660 1796 za732301.exe za987971.exe PID 4660 wrote to memory of 3748 4660 za987971.exe 61254245.exe PID 4660 wrote to memory of 3748 4660 za987971.exe 61254245.exe PID 4660 wrote to memory of 3748 4660 za987971.exe 61254245.exe PID 3748 wrote to memory of 868 3748 61254245.exe 1.exe PID 3748 wrote to memory of 868 3748 61254245.exe 1.exe PID 4660 wrote to memory of 1004 4660 za987971.exe u96726410.exe PID 4660 wrote to memory of 1004 4660 za987971.exe u96726410.exe PID 4660 wrote to memory of 1004 4660 za987971.exe u96726410.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe"C:\Users\Admin\AppData\Local\Temp\13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exeFilesize
1.3MB
MD5b3aabd99d980821be458cbd7c49f86dc
SHA1d4e0758dff28ffcf545fd3cd5b068e73b45a3a49
SHA256db5b8f7721f8527aaaa0536424f17b479355dea95d38b73743b2499178d70265
SHA512f230a46a89df5698dd6eb5211c8c68eae8a36ad49b0dffb785a14fce3e2927e88921ca5a665eb90759cad8e4c60eebcef5ad6557bd05cc9c80b3b898978e5ed9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exeFilesize
1.3MB
MD5b3aabd99d980821be458cbd7c49f86dc
SHA1d4e0758dff28ffcf545fd3cd5b068e73b45a3a49
SHA256db5b8f7721f8527aaaa0536424f17b479355dea95d38b73743b2499178d70265
SHA512f230a46a89df5698dd6eb5211c8c68eae8a36ad49b0dffb785a14fce3e2927e88921ca5a665eb90759cad8e4c60eebcef5ad6557bd05cc9c80b3b898978e5ed9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exeFilesize
883KB
MD56613bfaa73c1333ca6d7b9890d7be937
SHA1631ce1e5756201411ef975f6976f90dc1770a17d
SHA256812e02c698cbf8f3a9d833795340293b0494bb5bee82b27561d9157c4d908f2e
SHA51245f1b9d7bb1cbd26a54b26e70490c3713bb732a27fb28c7351190306c364e08da88d2e5f886f5ce086ab9199bd4dd49295b1f2284f57a6c645c816306303cc5a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exeFilesize
883KB
MD56613bfaa73c1333ca6d7b9890d7be937
SHA1631ce1e5756201411ef975f6976f90dc1770a17d
SHA256812e02c698cbf8f3a9d833795340293b0494bb5bee82b27561d9157c4d908f2e
SHA51245f1b9d7bb1cbd26a54b26e70490c3713bb732a27fb28c7351190306c364e08da88d2e5f886f5ce086ab9199bd4dd49295b1f2284f57a6c645c816306303cc5a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exeFilesize
700KB
MD5d923c2563c879731fc6d237a66153786
SHA16384057028e92e704b29260a864e1433c64f6762
SHA256b2f05fccc0eb5039125fd07dd7f89e9822146934bcd190a318aa09246b63cffd
SHA5128d8e6c24864fa6521a3a6345613e014e01a5e9d384e1d4ba5bc2a22dc6f00a09b4eb689cca413f644af2a9c441d041f8b660b80086aac539ac550a4651dc80ad
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exeFilesize
700KB
MD5d923c2563c879731fc6d237a66153786
SHA16384057028e92e704b29260a864e1433c64f6762
SHA256b2f05fccc0eb5039125fd07dd7f89e9822146934bcd190a318aa09246b63cffd
SHA5128d8e6c24864fa6521a3a6345613e014e01a5e9d384e1d4ba5bc2a22dc6f00a09b4eb689cca413f644af2a9c441d041f8b660b80086aac539ac550a4651dc80ad
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exeFilesize
300KB
MD58391bc437772a29ffae4b769790faa1c
SHA13b9455bd00427e49e4cedfbffa7bb95106e34513
SHA25672eddd576652c5c8a1fd2007adad7c4e89e183b734246001e6c48a988b0506e6
SHA512d5d187c1e907587a1df6e63875b4d6dac7e4f286cad041b5d0bd2297a2d3e6f110f2d88d3658d488174e30a8b1c6e9e9f009d4653d9d6f28d88069f64348ccb4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exeFilesize
300KB
MD58391bc437772a29ffae4b769790faa1c
SHA13b9455bd00427e49e4cedfbffa7bb95106e34513
SHA25672eddd576652c5c8a1fd2007adad7c4e89e183b734246001e6c48a988b0506e6
SHA512d5d187c1e907587a1df6e63875b4d6dac7e4f286cad041b5d0bd2297a2d3e6f110f2d88d3658d488174e30a8b1c6e9e9f009d4653d9d6f28d88069f64348ccb4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exeFilesize
479KB
MD5a5aa16ba2e76316f61fe263668916ad9
SHA11ea67ce94b55acd959f60fe9d8377298912d14e8
SHA256a651273804f0dcecfb4a5ac3ac8a94fd2570512d9e5765cb525a09ef2e47efe1
SHA5124d3ba814bdf6fbafe5f84a54f3df7c927fb0d8b75d3341e38d30bba9ce5e13c80735b8c73fc76b2c0cbcf1406a545c44c27793170d80ec23eafb9a1219e041eb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exeFilesize
479KB
MD5a5aa16ba2e76316f61fe263668916ad9
SHA11ea67ce94b55acd959f60fe9d8377298912d14e8
SHA256a651273804f0dcecfb4a5ac3ac8a94fd2570512d9e5765cb525a09ef2e47efe1
SHA5124d3ba814bdf6fbafe5f84a54f3df7c927fb0d8b75d3341e38d30bba9ce5e13c80735b8c73fc76b2c0cbcf1406a545c44c27793170d80ec23eafb9a1219e041eb
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
memory/868-2313-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/1004-2315-0x0000000000820000-0x000000000086C000-memory.dmpFilesize
304KB
-
memory/3748-189-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-202-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-167-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-169-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-171-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-173-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-177-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-175-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-179-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-181-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-183-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-185-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-187-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-163-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-191-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-193-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-195-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-197-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-194-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-198-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-200-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-165-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-204-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-206-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-208-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-210-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-212-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-214-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-216-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-218-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-222-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-220-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-224-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-226-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-228-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-162-0x0000000004AF0000-0x0000000004B41000-memory.dmpFilesize
324KB
-
memory/3748-161-0x0000000004BD0000-0x0000000005174000-memory.dmpFilesize
5.6MB
-
memory/3748-2294-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-2296-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-2295-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-2297-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/3748-2298-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB