Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 05:53
Behavioral task
behavioral1
Sample
96de9c78028eaec7cd06d8e3e755ffc4.exe
Resource
win7-20220812-en
General
-
Target
96de9c78028eaec7cd06d8e3e755ffc4.exe
-
Size
75KB
-
MD5
96de9c78028eaec7cd06d8e3e755ffc4
-
SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2
-
SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
-
SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
-
SSDEEP
1536:K3Mz8j5ZOooa0kCOrtEH1jBfSuh7wi5FLDtC:xwNZO3OpQ1VfPEi5Fft
Malware Config
Extracted
phorphiex
http://185.215.113.66/twizt/
12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v
Signatures
-
Processes:
winuedrvs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winuedrvs.exe -
Executes dropped EXE 3 IoCs
Processes:
winuedrvs.exe89464612.exe662825328.exepid process 1380 winuedrvs.exe 4080 89464612.exe 4124 662825328.exe -
Processes:
winuedrvs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winuedrvs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
96de9c78028eaec7cd06d8e3e755ffc4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winuedrvs.exe" 96de9c78028eaec7cd06d8e3e755ffc4.exe -
Drops file in Windows directory 2 IoCs
Processes:
96de9c78028eaec7cd06d8e3e755ffc4.exedescription ioc process File created C:\Windows\winuedrvs.exe 96de9c78028eaec7cd06d8e3e755ffc4.exe File opened for modification C:\Windows\winuedrvs.exe 96de9c78028eaec7cd06d8e3e755ffc4.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
96de9c78028eaec7cd06d8e3e755ffc4.exewinuedrvs.exedescription pid process target process PID 4528 wrote to memory of 1380 4528 96de9c78028eaec7cd06d8e3e755ffc4.exe winuedrvs.exe PID 4528 wrote to memory of 1380 4528 96de9c78028eaec7cd06d8e3e755ffc4.exe winuedrvs.exe PID 4528 wrote to memory of 1380 4528 96de9c78028eaec7cd06d8e3e755ffc4.exe winuedrvs.exe PID 1380 wrote to memory of 4080 1380 winuedrvs.exe 89464612.exe PID 1380 wrote to memory of 4080 1380 winuedrvs.exe 89464612.exe PID 1380 wrote to memory of 4080 1380 winuedrvs.exe 89464612.exe PID 1380 wrote to memory of 4124 1380 winuedrvs.exe 662825328.exe PID 1380 wrote to memory of 4124 1380 winuedrvs.exe 662825328.exe PID 1380 wrote to memory of 4124 1380 winuedrvs.exe 662825328.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96de9c78028eaec7cd06d8e3e755ffc4.exe"C:\Users\Admin\AppData\Local\Temp\96de9c78028eaec7cd06d8e3e755ffc4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\winuedrvs.exeC:\Windows\winuedrvs.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\89464612.exeC:\Users\Admin\AppData\Local\Temp\89464612.exe3⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\662825328.exeC:\Users\Admin\AppData\Local\Temp\662825328.exe3⤵
- Executes dropped EXE
PID:4124
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5ca7b8f20e45e2e40f30cea521e1c6490
SHA149e227b0a5d8bb8b37efbd2bbfd3cbeb4fbbd984
SHA25662a26c3f4e3e1f469e06d2d9d14da3bbe49d80363753bddf2f23862c8e91784c
SHA5122db1a78ac144bf09825ade6be684cc381b09e3cf6a8a5eeab1b09eb57a42bd4481ec8d7974e7592638b75be1c85216485844cc080bb5b81893c6aee3addafff9
-
Filesize
8KB
MD5ca7b8f20e45e2e40f30cea521e1c6490
SHA149e227b0a5d8bb8b37efbd2bbfd3cbeb4fbbd984
SHA25662a26c3f4e3e1f469e06d2d9d14da3bbe49d80363753bddf2f23862c8e91784c
SHA5122db1a78ac144bf09825ade6be684cc381b09e3cf6a8a5eeab1b09eb57a42bd4481ec8d7974e7592638b75be1c85216485844cc080bb5b81893c6aee3addafff9
-
Filesize
6KB
MD569171b8026f4437ea72ce1f37a22ca27
SHA16f8cffe2a8bdcb4f3955816e2b524cd7847be9eb
SHA256368c0f5e42a73e655f18a564b7e6cd53ca4ef702108c08b59f3fa819faec4655
SHA51266e93474c01a3cb01e17ea142f0ff07664738c5cf944b7352ef2955c2a084529884292cb8921a32207e8b78fb7ca6ae7d5ae6a8d84447d6c8a1cc38d1d9782ae
-
Filesize
6KB
MD569171b8026f4437ea72ce1f37a22ca27
SHA16f8cffe2a8bdcb4f3955816e2b524cd7847be9eb
SHA256368c0f5e42a73e655f18a564b7e6cd53ca4ef702108c08b59f3fa819faec4655
SHA51266e93474c01a3cb01e17ea142f0ff07664738c5cf944b7352ef2955c2a084529884292cb8921a32207e8b78fb7ca6ae7d5ae6a8d84447d6c8a1cc38d1d9782ae
-
Filesize
75KB
MD596de9c78028eaec7cd06d8e3e755ffc4
SHA1612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA256d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
SHA5125906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
-
Filesize
75KB
MD596de9c78028eaec7cd06d8e3e755ffc4
SHA1612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA256d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
SHA5125906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f