Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
09/07/2023, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
7d7356c0cfb9265b7e61bd38a99f68c7.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
7d7356c0cfb9265b7e61bd38a99f68c7.exe
Resource
win10v2004-20230703-en
General
-
Target
7d7356c0cfb9265b7e61bd38a99f68c7.exe
-
Size
219KB
-
MD5
7d7356c0cfb9265b7e61bd38a99f68c7
-
SHA1
007c599c04fe7b75911e24c6cfbccd768350fca7
-
SHA256
bcd079ed77301cc5f6a0443ccb3c5b4fe4a4b660ad61d5bcc40f0224c8c2da63
-
SHA512
b4025037ac51b0ee94c77ffcd8a7d26f79d15da9029c3b5dec727d4d310fcb69681e7722d3ec171b469a5ad39f092322e9faf803701d45202809e73e1863dea4
-
SSDEEP
3072:IahKyd2n31n5GWp1icKAArDZz4N9GhbkrNEk1GI8YyelYW+XgE4HfQUT:IahOnp0yN90QEW8LmmlWfQ4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1696 coverperform.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 7d7356c0cfb9265b7e61bd38a99f68c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7d7356c0cfb9265b7e61bd38a99f68c7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1696 coverperform.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1696 2404 7d7356c0cfb9265b7e61bd38a99f68c7.exe 28 PID 2404 wrote to memory of 1696 2404 7d7356c0cfb9265b7e61bd38a99f68c7.exe 28 PID 2404 wrote to memory of 1696 2404 7d7356c0cfb9265b7e61bd38a99f68c7.exe 28 PID 2404 wrote to memory of 1696 2404 7d7356c0cfb9265b7e61bd38a99f68c7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d7356c0cfb9265b7e61bd38a99f68c7.exe"C:\Users\Admin\AppData\Local\Temp\7d7356c0cfb9265b7e61bd38a99f68c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\coverperform.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5c37c6ac81e9c30c498df277fa543df08
SHA1a4d7e3b23d3ad93f9767f76029d9828c6fa7e8b6
SHA256d06fb3c9f02e16771a6a4d4b37c4683d5afaf2ed4c0121e195bdc9eef953a074
SHA5127300193cf0df0be98c084b8f2fdec89f529ee94d71c99c537ef8d4bd6d3e97dd089b41e9e73527ebbf87f3fefaa3de7bee1eaf9fea064386f094524d541c11c2
-
Filesize
96KB
MD5c37c6ac81e9c30c498df277fa543df08
SHA1a4d7e3b23d3ad93f9767f76029d9828c6fa7e8b6
SHA256d06fb3c9f02e16771a6a4d4b37c4683d5afaf2ed4c0121e195bdc9eef953a074
SHA5127300193cf0df0be98c084b8f2fdec89f529ee94d71c99c537ef8d4bd6d3e97dd089b41e9e73527ebbf87f3fefaa3de7bee1eaf9fea064386f094524d541c11c2