d8f172a8806c2d88522bcc2d07e5b123f7d59d36b3e0fa83b4c2ff167afbfea8

General

Target

c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe
Size

744KB
MD5

c45a6b50e9ab1a2c3b1b3e0c848e60ec
SHA1

d9341271f44f564ac439d3efb6eaaa54a414d8fa
SHA256

d8f172a8806c2d88522bcc2d07e5b123f7d59d36b3e0fa83b4c2ff167afbfea8
SHA512

88a9d9665a28b27e49bf86d82d81930e33af6a97e52402587a6cf07d87c32e2f958a07220c280bb3518fdcf65923546f455def721b27109db51f62f8e378a023
SSDEEP

12288:vBELjEV2tIJcEndCAFsnxCvgJAXV80BVrBoiaQNetqWQffG:vBEIAAFsxSgJeJy3qWse

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2624	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2028	WAPH.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	WAPH.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\WAPH.exe	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe
File opened for modification	C:\Windows\WAPH.exe	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe
File created	C:\Windows\uninstal.BAT	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-cd-c4-76-13-ec	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E233A3FF-6761-4B1A-BB87-0F7596520E73}	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E233A3FF-6761-4B1A-BB87-0F7596520E73}\WpadDecision = "0"	WAPH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-cd-c4-76-13-ec\WpadDecisionTime = 70645a4dd374da01	WAPH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	WAPH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E233A3FF-6761-4B1A-BB87-0F7596520E73}\3a-cd-c4-76-13-ec	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WAPH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	WAPH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E233A3FF-6761-4B1A-BB87-0F7596520E73}\WpadDecisionReason = "1"	WAPH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E233A3FF-6761-4B1A-BB87-0F7596520E73}\WpadDecisionTime = 70645a4dd374da01	WAPH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E233A3FF-6761-4B1A-BB87-0F7596520E73}\WpadNetworkName = "Network 3"	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-cd-c4-76-13-ec\WpadDecisionReason = "1"	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-cd-c4-76-13-ec\WpadDecision = "0"	WAPH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WAPH.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WAPH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	WAPH.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	WAPH.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe
Token: SeDebugPrivilege	2028	WAPH.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	WAPH.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2568	2028	WAPH.exe	29
PID 2028 wrote to memory of 2568	2028	WAPH.exe	29
PID 2028 wrote to memory of 2568	2028	WAPH.exe	29
PID 2028 wrote to memory of 2568	2028	WAPH.exe	29
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30
PID 2984 wrote to memory of 2624	2984	c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe	30

C:\Users\Admin\AppData\Local\Temp\c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe
"C:\Users\Admin\AppData\Local\Temp\c45a6b50e9ab1a2c3b1b3e0c848e60ec.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.BAT
  2⤵
  - Deletes itself
  PID:2624

C:\Windows\WAPH.exe
C:\Windows\WAPH.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files\Internet Explorer\iEXpLOrE.exE
  "C:\Program Files\Internet Explorer\iEXpLOrE.exE"
  2⤵
  PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WAPH.exe

Filesize
744KB

MD5
c45a6b50e9ab1a2c3b1b3e0c848e60ec

SHA1
d9341271f44f564ac439d3efb6eaaa54a414d8fa

SHA256
d8f172a8806c2d88522bcc2d07e5b123f7d59d36b3e0fa83b4c2ff167afbfea8

SHA512
88a9d9665a28b27e49bf86d82d81930e33af6a97e52402587a6cf07d87c32e2f958a07220c280bb3518fdcf65923546f455def721b27109db51f62f8e378a023

Download Submit
C:\Windows\uninstal.BAT

Filesize
190B

MD5
7cb32f687e3f878291812b9cd669c864

SHA1
bef2b4c931fff6b355931759b47648d0cc2bb775

SHA256
f73f781c7f8232ff551a3866b172d00151831afefb4e48172c0f7d3622a12e7d

SHA512
2a9df2a164271d5e06c57c456372a65958765bdbc12e8dd7ef2da4ba74cf60ed00c36e36cb7e181ef63c3c1863ebbc659340aba0e4e4f4f0eeaee6f22386c825

Download Submit
memory/2028-5-0x0000000000400000-0x00000000004C2200-memory.dmp

Filesize
776KB

Download
memory/2028-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2028-17-0x0000000000400000-0x00000000004C2200-memory.dmp

Filesize
776KB

Download
memory/2028-19-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2028-20-0x0000000000400000-0x00000000004C2200-memory.dmp

Filesize
776KB

Download
memory/2028-26-0x0000000000400000-0x00000000004C2200-memory.dmp

Filesize
776KB

Download
memory/2984-0-0x0000000000400000-0x00000000004C2200-memory.dmp

Filesize
776KB

Download
memory/2984-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2984-15-0x0000000000400000-0x00000000004C2200-memory.dmp

Filesize
776KB

Download

Analysis

Sharing