e02ab02e92eeffa04c08b59e8d0f419a83e880f550abd09e4c98f51eb25556f3

Analysis

max time kernel
134s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/06/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iron5decompiler.exe
Size 154KB
Sample240613-ptgwssshpr
SHA256 e02ab02e92eeffa04c08b59e8d0f419a83e880f550abd09e4c98f51eb25556f3
MD5 2701aef8b0ac8a3e2eaf4f149be596c3
SHA1 2b6f95b404a58a23655f9101b7289a1cefcf164b
SHA512 537e59b3e3dc87b587c81ed433fef95b3dc52f58584b3fd6fdd86d8b7dd0af5c2ba0fd6dc740c52a71a8e51e4f9441e100aac0d3214be7a1e29d08ba47f0b1e9
SSDEEP 3072:MahKyd2n31z5GWp1icKAArDZz4N9GhbkrNEk1kT:MahObp0yN90QE7
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	iron5decompiler.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4876	3900	iron5decompiler.exe	72
PID 3900 wrote to memory of 4876	3900	iron5decompiler.exe	72
PID 4876 wrote to memory of 4936	4876	cmd.exe	74
PID 4876 wrote to memory of 4936	4876	cmd.exe	74
PID 4936 wrote to memory of 3156	4936	cmd.exe	75
PID 4936 wrote to memory of 3156	4936	cmd.exe	75

C:\Users\Admin\AppData\Local\Temp\iron5decompiler.exe
"C:\Users\Admin\AppData\Local\Temp\iron5decompiler.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "iron5decompiler.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iron5decompiler.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\system32\findstr.exe
      findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iron5decompiler.bat"
      4⤵
      PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iron5decompiler.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iron5decompiler.bat
Size 1KB
SHA256 2f4cdf7ae69b523da388f2e8bd2cd9fc8d62d36ad9e1f9bf18b49af83229b8c2
MD5 2df2237a99f9a6581bff130175e775e9
SHA1 bbca645ce2870c603ef55f3c05e18b38cfd20b48
SHA512 404fe89854335ca03efd360ed80ad196654723edf6b81af7e0f205dc078449359023027ee47e0e8bad46ccf60b061db4eedfc7083e78f6501c04dc9635c5f115
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads