02550e6b73ccad2e990e79abbe3beb7e9b2c2e6af2135715eb5da29c84854267

Analysis

max time kernel
152s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2023, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpsetup[1].exe
Size

2.7MB
MD5

ac14f8acd86697ec4895045f55e92425
SHA1

e4662c7d071ea969f2977c4326039273e00ad866
SHA256

02550e6b73ccad2e990e79abbe3beb7e9b2c2e6af2135715eb5da29c84854267
SHA512

30617c07780d21ed6581eae90319a6e81bc6ccc377986b6111606ec98e373545d5ad3a2bd4a150ebc7be1f262e3657e45055b595343feb45be1a0878ea508e34
SSDEEP

49152:q/X+N6+P6N2QU1HSM+u+p10r1zqZKYRTE2NhPPZIX+Y3/QYGZas:D/w2QUgMPpzqZKc4mhPx3CQrx

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WavePadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpsetup[1].exe"	nchsetup.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	nchsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2864	1684	wpsetup[1].exe	86
PID 1684 wrote to memory of 2864	1684	wpsetup[1].exe	86
PID 1684 wrote to memory of 2864	1684	wpsetup[1].exe	86

C:\Users\Admin\AppData\Local\Temp\wpsetup[1].exe
"C:\Users\Admin\AppData\Local\Temp\wpsetup[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\wpsetup[1].exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
6.7MB

MD5
a01f914fb1e34520b07144973fd6133f

SHA1
5902aae4b09938303c6d533e2ef0c032bb30fc8f

SHA256
18e528e8ce879697fe3b6d1bdd3502a3543be7e8cfe6554c82837a4a2e9960fc

SHA512
28e6d24ebfef93b395ca1545bebc1eab4de550700fc6994932f3fb1ff1adf5a86f48f761f572bd87033d324037239e6855716bbdd777959b415ed211c949611c

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe

Filesize
6.7MB

MD5
a01f914fb1e34520b07144973fd6133f

SHA1
5902aae4b09938303c6d533e2ef0c032bb30fc8f

SHA256
18e528e8ce879697fe3b6d1bdd3502a3543be7e8cfe6554c82837a4a2e9960fc

SHA512
28e6d24ebfef93b395ca1545bebc1eab4de550700fc6994932f3fb1ff1adf5a86f48f761f572bd87033d324037239e6855716bbdd777959b415ed211c949611c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads