Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 20:37
Static task
static1
Behavioral task
behavioral1
Sample
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe
Resource
win7-20220718-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe
-
Size
277KB
-
MD5
7abb61412a064ced52fb6174352501d8
-
SHA1
51b2967bcbfb38ab1059eadf275b64fe9e0eedeb
-
SHA256
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd
-
SHA512
1ec6410bd09c081b6df36d27f101fcb60b870014fff09e2b3dd62107b5e2fa4f5cdb6213f5413d72abbdcc511f9b952229b39c5c5d9cc43b9625c485ecdee018
Score
10/10
Malware Config
Signatures
-
Processes:
winsvcs.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" winsvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" winsvcs.exe -
Processes:
winsvcs.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe -
Executes dropped EXE 1 IoCs
Processes:
winsvcs.exepid Process 3292 winsvcs.exe -
Processes:
winsvcs.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winsvcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\405068686303039040\\winsvcs.exe" 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\405068686303039040\\winsvcs.exe" 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe -
Drops file in Windows directory 3 IoCs
Processes:
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exedescription ioc Process File opened for modification C:\Windows\405068686303039040\winsvcs.exe 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe File opened for modification C:\Windows\405068686303039040 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe File created C:\Windows\405068686303039040\winsvcs.exe 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 5016 560 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exewinsvcs.exepid Process 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe 3292 winsvcs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exedescription pid Process procid_target PID 560 wrote to memory of 3292 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 83 PID 560 wrote to memory of 3292 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 83 PID 560 wrote to memory of 3292 560 5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe"C:\Users\Admin\AppData\Local\Temp\5e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\405068686303039040\winsvcs.exeC:\Windows\405068686303039040\winsvcs.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 5562⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 560 -ip 5601⤵PID:676
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277KB
MD57abb61412a064ced52fb6174352501d8
SHA151b2967bcbfb38ab1059eadf275b64fe9e0eedeb
SHA2565e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd
SHA5121ec6410bd09c081b6df36d27f101fcb60b870014fff09e2b3dd62107b5e2fa4f5cdb6213f5413d72abbdcc511f9b952229b39c5c5d9cc43b9625c485ecdee018
-
Filesize
277KB
MD57abb61412a064ced52fb6174352501d8
SHA151b2967bcbfb38ab1059eadf275b64fe9e0eedeb
SHA2565e53e3b297d0bb71ccd27f879a4452489befd413d695c3007972015539020acd
SHA5121ec6410bd09c081b6df36d27f101fcb60b870014fff09e2b3dd62107b5e2fa4f5cdb6213f5413d72abbdcc511f9b952229b39c5c5d9cc43b9625c485ecdee018