Analysis
-
max time kernel
29s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
20/05/2023, 12:15
General
-
Target
CXL-PaK-Extractor_setup_v2.1.exe
-
Size
743KB
-
MD5
a61768b6e2c0c38192e48be17e543c07
-
SHA1
3562977117ea9c7caca67f4c40a7e71ff4c0f449
-
SHA256
16de4099fd63580ebb2d8119e4f25eb3496d9e82afd9203ef7691e8f8c772027
-
SHA512
2ce36fcad4b6b3f383b2dee51b56fcf7b408a0450d4928dc1217dc4294166e1e045610b81a22ee01de7a6384b329734ceaff39c5ca9e22c06d070309078b26a3
-
SSDEEP
12288:H203Ont8dspFAVAe421XoyqqDfIIzrIGHuYahR5Gvyb08IpaQuAtfumZizbcjWcH:H20+nt8qppe4QRfxrImuYahPGvybUpdV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Program Files directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CXL-PaK-Extractor_setup_v2.1.exe"C:\Users\Admin\AppData\Local\Temp\CXL-PaK-Extractor_setup_v2.1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L5C67.tmp\CXL-PaK-Extractor_setup_v2.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-L5C67.tmp\CXL-PaK-Extractor_setup_v2.1.tmp" /SL5="$70124,517286,54272,C:\Users\Admin\AppData\Local\Temp\CXL-PaK-Extractor_setup_v2.1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694KB
MD5f0ccfb46f867443700d31c969bdcf552
SHA1f2474d5d7a906de3bc3381ca79bb1ea60f0d6697
SHA25654bb849d30567d5f10ac359f8b503732a3fcd76ad7cc72007eab843b784367bb
SHA51271c7de53d1db03f1149c3e82fd92842cbd284d17c981267b20290f8d54baf2b578f7830f64eb5308c82cf4aff4f1937586624c2769da74a463c8d4ebdcbe45ee
-
Filesize
694KB
MD5f0ccfb46f867443700d31c969bdcf552
SHA1f2474d5d7a906de3bc3381ca79bb1ea60f0d6697
SHA25654bb849d30567d5f10ac359f8b503732a3fcd76ad7cc72007eab843b784367bb
SHA51271c7de53d1db03f1149c3e82fd92842cbd284d17c981267b20290f8d54baf2b578f7830f64eb5308c82cf4aff4f1937586624c2769da74a463c8d4ebdcbe45ee
-
Filesize
659KB
MD5972dfe3615a47cf0e1fa1ad974d38318
SHA185847ffe0573788af1e6b56d7ce0370028439c67
SHA2568912ee9b2b6259ae87f5288559e6670b645bd473696a6cfaa6d9900696e7e022
SHA512935011e1ceea087eec5d990e2aa9535b6b9d37e2a5fb323712565bda26322ec3efb265a38274bb624810d00cee6157a6297664096792f9b76d30a095d413be1f
-
Filesize
694KB
MD5f0ccfb46f867443700d31c969bdcf552
SHA1f2474d5d7a906de3bc3381ca79bb1ea60f0d6697
SHA25654bb849d30567d5f10ac359f8b503732a3fcd76ad7cc72007eab843b784367bb
SHA51271c7de53d1db03f1149c3e82fd92842cbd284d17c981267b20290f8d54baf2b578f7830f64eb5308c82cf4aff4f1937586624c2769da74a463c8d4ebdcbe45ee
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4KB
-
Filesize
756KB
-
Filesize
80KB
-
Filesize
80KB