9d29e46279d436e1a9f05030b652779510edc61a9d4fb076b4b8b50a58496f48

General

Target

ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe
Size

4.7MB
MD5

e1b479517b08d166306f1cc258a1860e
SHA1

3ce511c50f9b8f8f80c9f2dd0e1fccdb22137dea
SHA256

ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb
SHA512

7be43e0aeda958b2c63b5961ba7bee46e77d1322b69a31b5e48bd7a99a280bb4f0a959b2169713952f4395ff60767565a06c811dbd8f5b8db11b09526c8bc229
SSDEEP

98304:XtwMrEmF6o69khxgoV55TJusJkEQefpCHH/B/JW7kqObjGAFGA3WwGcbeht6:XtwMrS1u9tJkERfp+9hGAFNGGZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
368	Setup.Exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Setup.Exe
File opened (read-only)	\??\Y:	Setup.Exe
File opened (read-only)	\??\A:	Setup.Exe
File opened (read-only)	\??\I:	Setup.Exe
File opened (read-only)	\??\L:	Setup.Exe
File opened (read-only)	\??\Q:	Setup.Exe
File opened (read-only)	\??\S:	Setup.Exe
File opened (read-only)	\??\T:	Setup.Exe
File opened (read-only)	\??\X:	Setup.Exe
File opened (read-only)	\??\E:	Setup.Exe
File opened (read-only)	\??\G:	Setup.Exe
File opened (read-only)	\??\J:	Setup.Exe
File opened (read-only)	\??\M:	Setup.Exe
File opened (read-only)	\??\N:	Setup.Exe
File opened (read-only)	\??\P:	Setup.Exe
File opened (read-only)	\??\U:	Setup.Exe
File opened (read-only)	\??\V:	Setup.Exe
File opened (read-only)	\??\B:	Setup.Exe
File opened (read-only)	\??\H:	Setup.Exe
File opened (read-only)	\??\Z:	Setup.Exe
File opened (read-only)	\??\W:	Setup.Exe
File opened (read-only)	\??\K:	Setup.Exe
File opened (read-only)	\??\O:	Setup.Exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	368	Setup.Exe
Token: SeIncreaseQuotaPrivilege	368	Setup.Exe
Token: SeSecurityPrivilege	1760	msiexec.exe
Token: SeCreateTokenPrivilege	368	Setup.Exe
Token: SeAssignPrimaryTokenPrivilege	368	Setup.Exe
Token: SeLockMemoryPrivilege	368	Setup.Exe
Token: SeIncreaseQuotaPrivilege	368	Setup.Exe
Token: SeMachineAccountPrivilege	368	Setup.Exe
Token: SeTcbPrivilege	368	Setup.Exe
Token: SeSecurityPrivilege	368	Setup.Exe
Token: SeTakeOwnershipPrivilege	368	Setup.Exe
Token: SeLoadDriverPrivilege	368	Setup.Exe
Token: SeSystemProfilePrivilege	368	Setup.Exe
Token: SeSystemtimePrivilege	368	Setup.Exe
Token: SeProfSingleProcessPrivilege	368	Setup.Exe
Token: SeIncBasePriorityPrivilege	368	Setup.Exe
Token: SeCreatePagefilePrivilege	368	Setup.Exe
Token: SeCreatePermanentPrivilege	368	Setup.Exe
Token: SeBackupPrivilege	368	Setup.Exe
Token: SeRestorePrivilege	368	Setup.Exe
Token: SeShutdownPrivilege	368	Setup.Exe
Token: SeDebugPrivilege	368	Setup.Exe
Token: SeAuditPrivilege	368	Setup.Exe
Token: SeSystemEnvironmentPrivilege	368	Setup.Exe
Token: SeChangeNotifyPrivilege	368	Setup.Exe
Token: SeRemoteShutdownPrivilege	368	Setup.Exe
Token: SeUndockPrivilege	368	Setup.Exe
Token: SeSyncAgentPrivilege	368	Setup.Exe
Token: SeEnableDelegationPrivilege	368	Setup.Exe
Token: SeManageVolumePrivilege	368	Setup.Exe
Token: SeImpersonatePrivilege	368	Setup.Exe
Token: SeCreateGlobalPrivilege	368	Setup.Exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
368	Setup.Exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 368	2784	ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe	92
PID 2784 wrote to memory of 368	2784	ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe	92
PID 2784 wrote to memory of 368	2784	ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe	92

C:\Users\Admin\AppData\Local\Temp\ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe
"C:\Users\Admin\AppData\Local\Temp\ad3d39bc31160d8078d263efd22d03e16642c9a5158fdcc201917f642edadbeb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.Exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.Exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.Exe

Filesize
18KB

MD5
7ec755faa3cb13a01972dce67ab2d4f6

SHA1
e577452d6b84ad26f9c3d71bfde67503e27c0016

SHA256
069c51b99b5cefed8fb4926e4ddc2a1b00c5cbc171fce95a7954e9381c045984

SHA512
6862b7bedb9fd1e839cb2a46281d6bfe68c7eab46ae50a3850d663b29a7b8d995e10aac0d1476648e35d49a2e20a39b64c0f6a6b1e6b53ed3b9cf31b27172e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WMITools.msi

Filesize
1KB

MD5
984677d93629346fb62bb2d0870ab260

SHA1
8780ed887272b41998cf4452410585478470e333

SHA256
79cc297248bdc82d08059a427e3e61e0bc6f5e65551361db8ae1e843c821e17d

SHA512
8cac60d356e24882cc89223e605e649099da2e831e5551b9a89e9307871bad813f1821b8dd6aaaff7f410c4ef480295f6c4cfc063b55f962e32eda3d18b1f12f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads