Analysis
-
max time kernel
32s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe
Resource
win10v2004-20230915-en
General
-
Target
43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe
-
Size
956KB
-
MD5
bc553eff5b4b8567f6691b3f345e890b
-
SHA1
f3dfb7d6a0689549b9d924ec1972f79c49b9a96c
-
SHA256
43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453
-
SHA512
99019020e34df2ee3b7fc32cdd4db53e8eda933d653d2a02933bb52bf1627a63be789abe914159331d41eb6e14b83286aac4ac9de2c1fddef1073cafc617186b
-
SSDEEP
24576:KyolDkDv+9yI4KGT6QImxABsPh1xS0vWQwaOAIPfMS:RYkYyIFwR1TxBE
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2652 x9643145.exe 2960 x3806825.exe 2756 x9683513.exe 2544 g3053198.exe -
Loads dropped DLL 13 IoCs
pid Process 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 2652 x9643145.exe 2652 x9643145.exe 2960 x3806825.exe 2960 x3806825.exe 2756 x9683513.exe 2756 x9683513.exe 2756 x9683513.exe 2544 g3053198.exe 2632 WerFault.exe 2632 WerFault.exe 2632 WerFault.exe 2632 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9643145.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x3806825.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x9683513.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2544 set thread context of 2564 2544 g3053198.exe 35 -
Program crash 2 IoCs
pid pid_target Process procid_target 2632 2544 WerFault.exe 33 3032 2564 WerFault.exe 35 -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2272 wrote to memory of 2652 2272 43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe 30 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2652 wrote to memory of 2960 2652 x9643145.exe 31 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2960 wrote to memory of 2756 2960 x3806825.exe 32 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2756 wrote to memory of 2544 2756 x9683513.exe 33 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2680 2544 g3053198.exe 34 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2544 wrote to memory of 2564 2544 g3053198.exe 35 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2564 wrote to memory of 3032 2564 AppLaunch.exe 37 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36 PID 2544 wrote to memory of 2632 2544 g3053198.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe"C:\Users\Admin\AppData\Local\Temp\43c2dc4d1595eae803346e406606bca2dac820fda89af1917d7762fb66cb2453.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9643145.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3806825.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9683513.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3053198.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 2687⤵
- Program crash
PID:3032
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 2806⤵
- Loads dropped DLL
- Program crash
PID:2632
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854KB
MD5890333ca9002375508504fcb648ac858
SHA1a38e843e37293f159e855b08a23efa19d3a80272
SHA2560d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa
SHA51297965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c
-
Filesize
854KB
MD5890333ca9002375508504fcb648ac858
SHA1a38e843e37293f159e855b08a23efa19d3a80272
SHA2560d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa
SHA51297965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c
-
Filesize
580KB
MD5693c13b73b88d3a0b0700b46e9968354
SHA1bee93506fd55ef121a60de7f54ea56b1564c70d0
SHA25616a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c
SHA51298b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d
-
Filesize
580KB
MD5693c13b73b88d3a0b0700b46e9968354
SHA1bee93506fd55ef121a60de7f54ea56b1564c70d0
SHA25616a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c
SHA51298b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d
-
Filesize
404KB
MD55fc9ce5165093ee758aab5555afd5ad0
SHA1c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1
SHA25657b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b
SHA512900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733
-
Filesize
404KB
MD55fc9ce5165093ee758aab5555afd5ad0
SHA1c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1
SHA25657b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b
SHA512900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
854KB
MD5890333ca9002375508504fcb648ac858
SHA1a38e843e37293f159e855b08a23efa19d3a80272
SHA2560d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa
SHA51297965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c
-
Filesize
854KB
MD5890333ca9002375508504fcb648ac858
SHA1a38e843e37293f159e855b08a23efa19d3a80272
SHA2560d4035174eac18016c596518166c080019dc4ca4d6431517d4eba610366630fa
SHA51297965d7a1f455441b1c6334fff5bf42769bf0743e33020c6d1702b9887442f8f53f924543e7f727488b55cea70f09fd82e645040f8a9715111cf92da3d66016c
-
Filesize
580KB
MD5693c13b73b88d3a0b0700b46e9968354
SHA1bee93506fd55ef121a60de7f54ea56b1564c70d0
SHA25616a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c
SHA51298b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d
-
Filesize
580KB
MD5693c13b73b88d3a0b0700b46e9968354
SHA1bee93506fd55ef121a60de7f54ea56b1564c70d0
SHA25616a4f73018248b3856e5b57f6257b3c947c35f640b74841cd05c6e20638cf74c
SHA51298b650f26aa0e5eb6a8d22e65a5d6a6d48202b72cb050f70d337f4e8ca9c131736bf936a5a257632bd3eee01c45b160c0f0a61aa6b98271d95e44257d0aba75d
-
Filesize
404KB
MD55fc9ce5165093ee758aab5555afd5ad0
SHA1c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1
SHA25657b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b
SHA512900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733
-
Filesize
404KB
MD55fc9ce5165093ee758aab5555afd5ad0
SHA1c4057c14f8ac5df3f4c6d3a1445bf641ba4dfed1
SHA25657b841463b196aea4b9a71597786cd94847c0f6c945e404d418e5582c432316b
SHA512900a9f64c2d30dd687ec680551e874dcc08127246ef72965a4599009e6c31e3134bb67e1ead669869d0f353d59c45acd6e48784432ab624783f371994fe9f733
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084
-
Filesize
396KB
MD5990f876fb678a1a40e7278c90be60411
SHA1f193c3018da9e115ed2d122de9f7dd8f4d053437
SHA2563da8b3174db326b473f2674d6e2776dbbc2b33d5ec003d152be9ae407f73738b
SHA512ece7dcf156f1926d7fc64af33ea0fe70a99d9552165f6bf451622310b70a51b1022d58252dfec0aef4bd10062f895f21639c21bd5a33d1a2c9f709b9f0941084