bdb8559a8f3e77711f0bcf32d2a7af6d2b1559011c1700e8431296ea8d13dda3

General

Target

Bypass.exe
Size

154KB
MD5

6f8d337edc954a1f9cc605fed3cfc665
SHA1

fb11e670fc612fc92ba92358d5a4d9918295c3f2
SHA256

bdb8559a8f3e77711f0bcf32d2a7af6d2b1559011c1700e8431296ea8d13dda3
SHA512

df1206840f3e08e9528146e4758e0ea3fd59023b6907f8658a195e60e249b26dbca93fcc500199e95d28481cd45dc0519c976357ee0c849efa9e058b68460cc4
SSDEEP

3072:tahKyd2n3115GWp1icKAArDZz4N9GhbkrNEk1pT:tahOBp0yN90QEe

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Bypass.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1976	PING.EXE
1740	PING.EXE
4576	PING.EXE
3564	PING.EXE
3940	PING.EXE
376	PING.EXE
4572	PING.EXE
1768	PING.EXE
2648	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery

T1018

pid	Process
3940	PING.EXE
376	PING.EXE
1976	PING.EXE
4572	PING.EXE
4576	PING.EXE
3564	PING.EXE
1740	PING.EXE
1768	PING.EXE
2648	PING.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 3224	3976	Bypass.exe	84
PID 3976 wrote to memory of 3224	3976	Bypass.exe	84
PID 3224 wrote to memory of 1732	3224	cmd.exe	86
PID 3224 wrote to memory of 1732	3224	cmd.exe	86
PID 1732 wrote to memory of 2800	1732	net.exe	87
PID 1732 wrote to memory of 2800	1732	net.exe	87
PID 3224 wrote to memory of 3940	3224	cmd.exe	88
PID 3224 wrote to memory of 3940	3224	cmd.exe	88
PID 3224 wrote to memory of 376	3224	cmd.exe	92
PID 3224 wrote to memory of 376	3224	cmd.exe	92
PID 3224 wrote to memory of 1976	3224	cmd.exe	97
PID 3224 wrote to memory of 1976	3224	cmd.exe	97
PID 3224 wrote to memory of 1740	3224	cmd.exe	100
PID 3224 wrote to memory of 1740	3224	cmd.exe	100
PID 3224 wrote to memory of 4572	3224	cmd.exe	101
PID 3224 wrote to memory of 4572	3224	cmd.exe	101
PID 3224 wrote to memory of 1768	3224	cmd.exe	102
PID 3224 wrote to memory of 1768	3224	cmd.exe	102
PID 3224 wrote to memory of 4576	3224	cmd.exe	104
PID 3224 wrote to memory of 4576	3224	cmd.exe	104
PID 3224 wrote to memory of 2648	3224	cmd.exe	105
PID 3224 wrote to memory of 2648	3224	cmd.exe	105
PID 3224 wrote to memory of 3564	3224	cmd.exe	106
PID 3224 wrote to memory of 3564	3224	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\Bypass.exe
"C:\Users\Admin\AppData\Local\Temp\Bypass.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "Bypass.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2800
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3940
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:376
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1976
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1740
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4572
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1768
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4576
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2648
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bypass.bat

Filesize
1KB

MD5
278331df65aa71c26721800defb48098

SHA1
28bbf8e4ef6e85bbd40612d0afa6528484d47443

SHA256
c3268d1ef6a27345fe0277727433a7214b27c1de05a2afbeffcea1109a111ca4

SHA512
526b5e1d0279280f28a7549aa7b786b5d643e450383aaebe4371fb808bd68cfa366e5700ed0c9fc7d4f96480ed8829e5af0bedac4218eaa3afbc6d53b8c18d05

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads