757e8e0d877c4f6e3ee83dcfb19b03871b2a11592db3fd2e930d6020d5a1422b

Analysis

max time kernel
133s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09104d1e60e897712568dbca8c54cace.exe
Size

629KB
MD5

09104d1e60e897712568dbca8c54cace
SHA1

75ac14370f0a94b57b28a21cf23b15785c31700b
SHA256

757e8e0d877c4f6e3ee83dcfb19b03871b2a11592db3fd2e930d6020d5a1422b
SHA512

72b553d55ad6195ef36df133f6b6da4fa36da25c41f786235d898cb1ea0368b1d7fb53cd9bfa1699303ed1eb6fb8dd43a7f45642508345eab5d3ee8af87b9e99
SSDEEP

12288:MlIFreXlWDAFWGijeZZICG5l1gx41c2obY7rwtN5yfMe:MSAO5GijeZXG5PgxqocwkUe

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2848	03VMP~1.EXE
2944	windows.exe

Loads dropped DLL 2 IoCs

pid	Process
2952	09104d1e60e897712568dbca8c54cace.exe
2952	09104d1e60e897712568dbca8c54cace.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	09104d1e60e897712568dbca8c54cace.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	windows.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\windows.exe	03VMP~1.EXE
File opened for modification	C:\Windows\windows.exe	03VMP~1.EXE
File created	C:\Windows\DELME.BAT	03VMP~1.EXE

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDetectedUrl	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecisionTime = 9075e416153bda01	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecision = "0"	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecisionTime = 9075e416153bda01	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecision = "0"	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\16-78-73-69-24-b6	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecisionReason = "1"	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecisionTime = 7071e0e4143bda01	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadNetworkName = "Network 3"	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6	windows.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	windows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	windows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecisionReason = "1"	windows.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecisionTime = 7071e0e4143bda01	windows.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	03VMP~1.EXE
Token: SeDebugPrivilege	2944	windows.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	windows.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2848	2952	09104d1e60e897712568dbca8c54cace.exe	28
PID 2952 wrote to memory of 2848	2952	09104d1e60e897712568dbca8c54cace.exe	28
PID 2952 wrote to memory of 2848	2952	09104d1e60e897712568dbca8c54cace.exe	28
PID 2952 wrote to memory of 2848	2952	09104d1e60e897712568dbca8c54cace.exe	28
PID 2944 wrote to memory of 1704	2944	windows.exe	30
PID 2944 wrote to memory of 1704	2944	windows.exe	30
PID 2944 wrote to memory of 1704	2944	windows.exe	30
PID 2944 wrote to memory of 1704	2944	windows.exe	30
PID 2848 wrote to memory of 1392	2848	03VMP~1.EXE	31
PID 2848 wrote to memory of 1392	2848	03VMP~1.EXE	31
PID 2848 wrote to memory of 1392	2848	03VMP~1.EXE	31
PID 2848 wrote to memory of 1392	2848	03VMP~1.EXE	31

C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe
"C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\DELME.BAT
    3⤵
    PID:1392

C:\Windows\windows.exe
C:\Windows\windows.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE

Filesize
245KB

MD5
7e64a0ed5d08b31b4692d9d5897c4c53

SHA1
6dc34000abea2ee04af907f87b56611e19141038

SHA256
621e24a22f346f3f119add56207e06f5f0168b7609d2befd4e6a39de1b05f9cc

SHA512
03a573c70d4fcddeb858567bead8c396149cd3505236e92aedae923e6d0e6a6f096655f8c837280627fb88e75313b422e093b51c5bfab460c9fe5b6426ab2efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE

Filesize
197KB

MD5
0d2b88551c876be0320f035140101c42

SHA1
4fae0937ae085087062d5af0e5ea6e749a5df366

SHA256
693c25186ec79bf8ab51d45031ca698316109d1116bbbcbebb5b0d84f25f5996

SHA512
ea485d2b58da3fe7cb4b83ef24761a538166a90db4d5b5dd9f0aeed541ae910e684a4eeb613770329b0138f28a7e4e9be197f5671c9f5fd8da4dc850e8c81194

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE

Filesize
77KB

MD5
94100acfc2ae822d1ce1f1a33266312f

SHA1
bebef8ba8189d8ebfc40fd9c4090aad200cd57f6

SHA256
7b99e1d094fcf47dd737ba7ed1b2c4fc290c6e306190e3c8e562a33e6a4bc7d6

SHA512
ba9db2beca0b145410cb844edb7929fb0829e39c2ef4fd07558fd4191d8f915685225598d1e4b3ff9dd2068880ddacd1aaa55e54d94c18391104e9621f8ef802

Download Submit
C:\Windows\DELME.BAT

Filesize
162B

MD5
5b55a72b3bbb2a259e579d35ebce588d

SHA1
507210b1f4a6d020c71160a487962c97425af3a1

SHA256
301923c7e29ee0546da3792740836d0d9640cbe3d682c0de59ec2b76438dcbfb

SHA512
9dcbe10e1d166419dac2f9b168a6e4c70ee82e9831f6629e1f3ce81c2864e3994b0952e73784b4c4c7dcf333ed9e72449f82c9b800312440c71d21cf305eb40b

Download Submit
C:\Windows\windows.exe

Filesize
160KB

MD5
1025be2f42f35a71f0d63d34a11b5af5

SHA1
026e6285ff0708e9ad37ed9d06c4b215ff419ae7

SHA256
d5a526a8a9cdadff5e04fd71d9d29b437ef510de5e8bc7f6ae83a1f21ba9371c

SHA512
93d7ed43039016c2c33fc115b36f26896daec3a88bec3213d9f6eb45d4e54badc72b44093192a958fd5b31235d41540f1aa6c681721a74facbf48b7db9381315

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE

Filesize
311KB

MD5
efda3ec8420d0caa4f238ecff9e4796b

SHA1
a2ef5df4ad2f6922409b4d8e07af847df0425ff6

SHA256
0f3b99e0b17f4b4497023e15c061405b778b834aa474e3d7fa2279e3d6a78864

SHA512
f11057aadf6bfce08c3c98fbdb07403e30ddf9c0b90781ff1d027d152ea11ab455baef23826e4c388310e9183b3b726a6560f028d301fb1a432e65ae35427f00

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE

Filesize
292KB

MD5
ff92b8b13512e835b2b7a63de25500e5

SHA1
434061b8da121068ec7cc27fb3052a7a1ec444d0

SHA256
46f36adbea3cb13ea865f771ad42127661afa83e7276504e3fef51668ccb7fdd

SHA512
008f9653ab1c52368a5b1963912110ba069dbd0a73fedb7244be669dc4445cc89df9dc37fb15b6ba9bfaf4d2502991c7ab216dc0bf31954a1f7a33275890f08f

Download Submit
memory/2848-45-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2848-65-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2848-43-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2848-46-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2848-48-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2944-58-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2944-52-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2944-53-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2944-69-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2944-70-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2952-15-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/2952-13-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2952-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2952-7-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2952-6-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2952-5-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2952-4-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2952-3-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2952-2-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2952-34-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/2952-33-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/2952-32-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/2952-31-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2952-30-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2952-29-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/2952-28-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2952-11-0x00000000029B0000-0x00000000029B4000-memory.dmp

Filesize
16KB

Download
memory/2952-12-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/2952-42-0x0000000002D20000-0x0000000002E44000-memory.dmp

Filesize
1.1MB

Download
memory/2952-9-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/2952-14-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2952-0-0x0000000001000000-0x00000000010AD000-memory.dmp

Filesize
692KB

Download
memory/2952-44-0x0000000002D20000-0x0000000002E44000-memory.dmp

Filesize
1.1MB

Download
memory/2952-16-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/2952-17-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/2952-18-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/2952-19-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2952-22-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/2952-23-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2952-57-0x0000000001000000-0x00000000010AD000-memory.dmp

Filesize
692KB

Download
memory/2952-24-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/2952-26-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/2952-27-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/2952-25-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/2952-66-0x0000000001000000-0x00000000010AD000-memory.dmp

Filesize
692KB

Download
memory/2952-67-0x00000000001B0000-0x0000000000200000-memory.dmp

Filesize
320KB

Download
memory/2952-10-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2952-1-0x00000000001B0000-0x0000000000200000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads