2c719082cd97cddd70853c6329b8563754d8a15641015cb46fa44e53d3bc459d

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:30

Target

3d842cfa7b26b6ae90e46b22a47e57e4.exe
Size

40KB
MD5

3d842cfa7b26b6ae90e46b22a47e57e4
SHA1

fde3477578c870b07ce36760d339df3cbfdf5124
SHA256

2c719082cd97cddd70853c6329b8563754d8a15641015cb46fa44e53d3bc459d
SHA512

667aa77679e5f109289fa40cc07204c7ab2cd67ecd5fa93667dff52e392adf8c86888aeadf3f828ec146338008c4b3047fda40eed2514a67076c446cf01cdc55
SSDEEP

768:fIN6T/1rkELDMEn2W1bO+OhfTq2AzYQr/RSzmW1ZjGNcd:a6Vn2mS+mq2AE+imW1lMcd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
624	mscpxldu.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mscpxldu.exe	3d842cfa7b26b6ae90e46b22a47e57e4.exe
File opened for modification	C:\Windows\SysWOW64\mscpxldu.exe	3d842cfa7b26b6ae90e46b22a47e57e4.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mscpxldu.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mscpxldu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2404	624	mscpxldu.exe	32
PID 624 wrote to memory of 2404	624	mscpxldu.exe	32
PID 624 wrote to memory of 2404	624	mscpxldu.exe	32
PID 624 wrote to memory of 2404	624	mscpxldu.exe	32

C:\Users\Admin\AppData\Local\Temp\3d842cfa7b26b6ae90e46b22a47e57e4.exe
"C:\Users\Admin\AppData\Local\Temp\3d842cfa7b26b6ae90e46b22a47e57e4.exe"
1⤵
- Drops file in System32 directory
PID:2432

C:\Windows\SysWOW64\mscpxldu.exe
C:\Windows\SysWOW64\mscpxldu.exe /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\reg.exe
  C:\Windows\Sysnative\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v TermUser /t REG_DWORD /d 0
  2⤵
  PID:2404

C:\Windows\SysWOW64\mscpxldu.exe

Filesize
40KB

MD5
3d842cfa7b26b6ae90e46b22a47e57e4

SHA1
fde3477578c870b07ce36760d339df3cbfdf5124

SHA256
2c719082cd97cddd70853c6329b8563754d8a15641015cb46fa44e53d3bc459d

SHA512
667aa77679e5f109289fa40cc07204c7ab2cd67ecd5fa93667dff52e392adf8c86888aeadf3f828ec146338008c4b3047fda40eed2514a67076c446cf01cdc55

Download Submit
memory/624-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/624-15-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/624-16-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2432-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download