78044ff8f74edccd5579136ba1d670ce4f382444735c3885ab0542dd2b77ce63

Analysis

max time kernel
143s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe
Size

803KB
MD5

5aacc978e30e235a1dce9e840e39af43
SHA1

7f4e4359b1bfe0e961e0f56748349e7305c098a7
SHA256

52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8
SHA512

a6bdd0a1207d27e0f4d1ea6a4f5f8d2f0f991c0793149f7ce89b1474a443c3d17ac178b4142544107df42750be24d9a20a214b241a67d026e2e4c15060728d09
SSDEEP

12288:WMrsy90+EdYGF/dYrO/K3M2552xWH/XypBUBTq0wuZnB3GiNk7RaWI0cC79Yj11C:WylEbF6a/Km+/XypaxwuZnVFN6R0uhd

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3636	11JL7015.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3636	1220	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	82
PID 1220 wrote to memory of 3636	1220	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	82
PID 1220 wrote to memory of 3636	1220	52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe	82

C:\Users\Admin\AppData\Local\Temp\52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe
"C:\Users\Admin\AppData\Local\Temp\52fd0a92cd193f49dd929ce5ff9680fad847ee599a1bcf1b3d85bf92a28149e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11JL7015.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11JL7015.exe
  2⤵
  - Executes dropped EXE
  PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\11JL7015.exe

Filesize
414KB

MD5
4458a3b4ea84f6b01c1c2eb130e5dc88

SHA1
4a86f29e61226525b8a3ebe907d9b552c4fc9b3d

SHA256
215160f0b3e658359a8a74e089b70cd8fd2acf7721ccbbfdfc48aff86e8ab527

SHA512
1741ccd7a4f7c2d724ed8b786268e84a340d136aff98260df407bde52d085eb4ecf131e764fafa731781be0832d5ffd77f882f9189a0de85d77c70d99768366d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads