Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 13:30
Static task
static1
Behavioral task
behavioral1
Sample
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe
Resource
win10v2004-20220414-en
General
-
Target
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe
-
Size
187KB
-
MD5
247209d2f18ecdefb4d7878d989fb6c7
-
SHA1
bb5319e0cb0088cbafe8b838a140b9f9c497adbe
-
SHA256
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
-
SHA512
9526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
Malware Config
Signatures
-
Processes:
winsvcs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" winsvcs.exe -
Processes:
winsvcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe -
Executes dropped EXE 1 IoCs
Processes:
winsvcs.exepid process 1456 winsvcs.exe -
Loads dropped DLL 2 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exepid process 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Processes:
winsvcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\708047050608564070\\winsvcs.exe" 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\708047050608564070\\winsvcs.exe" 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Drops file in Windows directory 3 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exedescription ioc process File opened for modification C:\Windows\708047050608564070\winsvcs.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe File opened for modification C:\Windows\708047050608564070 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe File created C:\Windows\708047050608564070\winsvcs.exe 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exewinsvcs.exepid process 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe 1456 winsvcs.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exepid process 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exedescription pid process target process PID 1884 wrote to memory of 1456 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe PID 1884 wrote to memory of 1456 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe PID 1884 wrote to memory of 1456 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe PID 1884 wrote to memory of 1456 1884 29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe winsvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe"C:\Users\Admin\AppData\Local\Temp\29b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
-
C:\Windows\708047050608564070\winsvcs.exeC:\Windows\708047050608564070\winsvcs.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\708047050608564070\winsvcs.exeFilesize
187KB
MD5247209d2f18ecdefb4d7878d989fb6c7
SHA1bb5319e0cb0088cbafe8b838a140b9f9c497adbe
SHA25629b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
SHA5129526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
-
C:\Windows\708047050608564070\winsvcs.exeFilesize
187KB
MD5247209d2f18ecdefb4d7878d989fb6c7
SHA1bb5319e0cb0088cbafe8b838a140b9f9c497adbe
SHA25629b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
SHA5129526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
-
\Windows\708047050608564070\winsvcs.exeFilesize
187KB
MD5247209d2f18ecdefb4d7878d989fb6c7
SHA1bb5319e0cb0088cbafe8b838a140b9f9c497adbe
SHA25629b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
SHA5129526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
-
\Windows\708047050608564070\winsvcs.exeFilesize
187KB
MD5247209d2f18ecdefb4d7878d989fb6c7
SHA1bb5319e0cb0088cbafe8b838a140b9f9c497adbe
SHA25629b1cf97d4c89bf83d4dd4f1447c3c36935ce2ec3e05ca56d47c9f3e2e581909
SHA5129526e76458717c39453a700e2ec14c5748876cc7a1d62c5546923591be7123a2c36111bfda6bceda0473dfe41b0c787e70aa65641d5f165bd8accaeb3b835dc1
-
memory/1456-64-0x0000000000502000-0x0000000000508000-memory.dmpFilesize
24KB
-
memory/1456-60-0x0000000000000000-mapping.dmp
-
memory/1456-62-0x0000000000502000-0x0000000000508000-memory.dmpFilesize
24KB
-
memory/1456-65-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1456-67-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1884-57-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1884-56-0x0000000000312000-0x0000000000318000-memory.dmpFilesize
24KB
-
memory/1884-54-0x0000000000312000-0x0000000000318000-memory.dmpFilesize
24KB
-
memory/1884-55-0x00000000759E1000-0x00000000759E3000-memory.dmpFilesize
8KB