Analysis
-
max time kernel
190s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-05-2022 02:45
Static task
static1
Behavioral task
behavioral1
Sample
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe
Resource
win7-20220414-en
General
-
Target
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe
-
Size
638KB
-
MD5
043bbfccd9e9deebe4559e291dbebda1
-
SHA1
0e6da4ccaed482767eb94a61679b5f24375f24d3
-
SHA256
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4
-
SHA512
41e4ea16800ddc0078eca1260f6ef07cd33a1c849802437a2c5868a4bf2fc4ee8b4f480f63e30f88d6e63eab733916fe5f6ec8fd2d3ce91a8bd6bfa4c98a4cc5
Malware Config
Signatures
-
Processes:
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe -
Processes:
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 904 3452 WerFault.exe iexplore.exe 1836 4396 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exedescription pid process target process PID 3316 set thread context of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 4888 set thread context of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 set thread context of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exe683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exepid process 3120 powershell.exe 3120 powershell.exe 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3120 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exepid process 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exedescription pid process target process PID 3316 wrote to memory of 3120 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe powershell.exe PID 3316 wrote to memory of 3120 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe powershell.exe PID 3316 wrote to memory of 3120 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe powershell.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 3316 wrote to memory of 4888 3316 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 3452 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe PID 4888 wrote to memory of 4396 4888 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe"C:\Users\Admin\AppData\Local\Temp\683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe"1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe"C:\Users\Admin\AppData\Local\Temp\683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\683a36a87b827244db7f998e92ab4702563dd3075bb4fea97ee7ec239f81fed4.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3452 -ip 34521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4396 -ip 43961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3120-142-0x0000000006B00000-0x0000000006B1E000-memory.dmpFilesize
120KB
-
memory/3120-149-0x0000000007ED0000-0x0000000007F66000-memory.dmpFilesize
600KB
-
memory/3120-143-0x00000000060C0000-0x00000000060F2000-memory.dmpFilesize
200KB
-
memory/3120-152-0x0000000007E30000-0x0000000007E38000-memory.dmpFilesize
32KB
-
memory/3120-144-0x000000006FFA0000-0x000000006FFEC000-memory.dmpFilesize
304KB
-
memory/3120-150-0x00000000072F0000-0x00000000072FE000-memory.dmpFilesize
56KB
-
memory/3120-136-0x0000000000000000-mapping.dmp
-
memory/3120-137-0x0000000004EC0000-0x0000000004EF6000-memory.dmpFilesize
216KB
-
memory/3120-138-0x0000000005600000-0x0000000005C28000-memory.dmpFilesize
6.2MB
-
memory/3120-139-0x00000000055D0000-0x00000000055F2000-memory.dmpFilesize
136KB
-
memory/3120-140-0x00000000064B0000-0x0000000006516000-memory.dmpFilesize
408KB
-
memory/3120-141-0x00000000065D0000-0x0000000006636000-memory.dmpFilesize
408KB
-
memory/3120-148-0x00000000063A0000-0x00000000063AA000-memory.dmpFilesize
40KB
-
memory/3120-147-0x0000000006350000-0x000000000636A000-memory.dmpFilesize
104KB
-
memory/3120-151-0x0000000007E50000-0x0000000007E6A000-memory.dmpFilesize
104KB
-
memory/3120-145-0x00000000060A0000-0x00000000060BE000-memory.dmpFilesize
120KB
-
memory/3120-146-0x0000000008370000-0x00000000089EA000-memory.dmpFilesize
6.5MB
-
memory/3316-132-0x0000000005A50000-0x0000000005FF4000-memory.dmpFilesize
5.6MB
-
memory/3316-131-0x0000000005400000-0x000000000549C000-memory.dmpFilesize
624KB
-
memory/3316-135-0x0000000005690000-0x00000000056E6000-memory.dmpFilesize
344KB
-
memory/3316-134-0x00000000054E0000-0x00000000054EA000-memory.dmpFilesize
40KB
-
memory/3316-133-0x0000000005540000-0x00000000055D2000-memory.dmpFilesize
584KB
-
memory/3316-130-0x00000000009F0000-0x0000000000A94000-memory.dmpFilesize
656KB
-
memory/4888-159-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4888-153-0x0000000000000000-mapping.dmp
-
memory/4888-154-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4888-156-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB