Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18-09-2023 10:51
Static task
static1
Behavioral task
behavioral1
Sample
wininstal.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
wininstal.exe
Resource
win10v2004-20230915-en
General
-
Target
wininstal.exe
-
Size
607KB
-
MD5
dd81fe6d37b5200c80eccb98bc8b91d9
-
SHA1
55371613874ea2109b6fc42f929e15f8544cb532
-
SHA256
7d5455411512b3e4fa266722bc5bfd18d73b84edf984543f12b40bfc274a70c7
-
SHA512
fc2525ec43c03ab7f2c9dfed92f18ec58ef79e962bc2089da90bc565d5d8d8564d9bf4d545c26fdb271c5b88d5ba47c73225f37f49ca1ffff17d427361aefb4a
-
SSDEEP
12288:bisrBllxd6M2YYKZ7UcxrGJnFdz87yrqE3Wopb7z1fbJBRi1rMM17o4:bdNllr6MWKZ7Uc0JnLpqED7z1frw1MMB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
severalmaintain.exepid process 2604 severalmaintain.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wininstal.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" wininstal.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
severalmaintain.exedescription pid process Token: SeDebugPrivilege 2604 severalmaintain.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wininstal.exedescription pid process target process PID 2228 wrote to memory of 2604 2228 wininstal.exe severalmaintain.exe PID 2228 wrote to memory of 2604 2228 wininstal.exe severalmaintain.exe PID 2228 wrote to memory of 2604 2228 wininstal.exe severalmaintain.exe PID 2228 wrote to memory of 2604 2228 wininstal.exe severalmaintain.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wininstal.exe"C:\Users\Admin\AppData\Local\Temp\wininstal.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\severalmaintain.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\severalmaintain.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\severalmaintain.exeFilesize
691KB
MD586dd34758b6ce7454cc907357c47d697
SHA19abc68a284b8f8969649c77f05020c0cabc9f517
SHA256e0095e1a312cb6f007e51605fde1c304a1f6f62e9f329766c75f3601d961ed45
SHA5123494cdbd5dc3b04c46cf660e3a8b8ae9985d248d885f0b389449d3ded5c1cf4d33e1878dd95c163ddaa53e6ee809f188de0ad4f7d5bab755f1df9bf404fb2545
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\severalmaintain.exeFilesize
691KB
MD586dd34758b6ce7454cc907357c47d697
SHA19abc68a284b8f8969649c77f05020c0cabc9f517
SHA256e0095e1a312cb6f007e51605fde1c304a1f6f62e9f329766c75f3601d961ed45
SHA5123494cdbd5dc3b04c46cf660e3a8b8ae9985d248d885f0b389449d3ded5c1cf4d33e1878dd95c163ddaa53e6ee809f188de0ad4f7d5bab755f1df9bf404fb2545
-
memory/2604-8-0x0000000001050000-0x0000000001104000-memory.dmpFilesize
720KB
-
memory/2604-9-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/2604-10-0x0000000004B80000-0x0000000004BC0000-memory.dmpFilesize
256KB
-
memory/2604-11-0x0000000074750000-0x0000000074E3E000-memory.dmpFilesize
6.9MB
-
memory/2604-12-0x0000000004B80000-0x0000000004BC0000-memory.dmpFilesize
256KB