2923eb641afb88d075014d69d280254fc01523bf5c10c17ac8d4e514fc8bdd6a

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 08:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79b8acb3ae0591ae8c7e5e8f89d361df.exe
Size

624KB
MD5

79b8acb3ae0591ae8c7e5e8f89d361df
SHA1

71c5dfb461c353d252607e2c1be68ba518003f04
SHA256

2923eb641afb88d075014d69d280254fc01523bf5c10c17ac8d4e514fc8bdd6a
SHA512

58bd12ba68549ca14c7e85410cf98529023212a728e388338c185d6d1d8f2364254f4e12eb7b00b2b314e905f656bc2475d7156c8f65be2cdbf116d6fc1b35eb
SSDEEP

12288:rBMg87HQzaovZVeGVQ4GOapl/eOfTn+bjCv6BFbTLVDZE:rBx4wzaCr64GPeqn+vCvY1pDZE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2188	whVIP.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	79b8acb3ae0591ae8c7e5e8f89d361df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2188	1856	79b8acb3ae0591ae8c7e5e8f89d361df.exe	86
PID 1856 wrote to memory of 2188	1856	79b8acb3ae0591ae8c7e5e8f89d361df.exe	86
PID 1856 wrote to memory of 2188	1856	79b8acb3ae0591ae8c7e5e8f89d361df.exe	86

C:\Users\Admin\AppData\Local\Temp\79b8acb3ae0591ae8c7e5e8f89d361df.exe
"C:\Users\Admin\AppData\Local\Temp\79b8acb3ae0591ae8c7e5e8f89d361df.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whVIP.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whVIP.exe
  2⤵
  - Executes dropped EXE
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whVIP.exe

Filesize
708KB

MD5
a72bf4560bcec8de52cdbe845dce01a2

SHA1
bf1a24ae8a7cf4a3706b149e93cd11c9f2c3a7fb

SHA256
0ba2b693ad4ac762f92721acb1587449a2a14ed4dad9839d10e0d2e2750c6ef8

SHA512
c74257ef73129411365c30d3d31e9da0205f6a5c9edf9a07480b58502ca5d6d6fe9f7b87de393d568a5b6815a9b0bb6977b6132cb91ecc6a00eaf879bdd08fa7

Download Submit
memory/2188-5-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2188-6-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads