Analysis
-
max time kernel
34s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 14:57
Static task
static1
Behavioral task
behavioral1
Sample
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
Resource
win7-20220812-en
General
-
Target
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe
-
Size
473KB
-
MD5
87bc1902b89ac09e8904fb77f997bf02
-
SHA1
7f193a3ca6f3e20e005d1890ccc30197ef5df1e0
-
SHA256
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f
-
SHA512
8fa91c61513b80fcb67ecc1640359db4c481013346f7ced0d79afa08bbd5621282f57e29fd8014e7f2f651cda68705874a2e22e9340d77bf7c77b531cb86fb8e
-
SSDEEP
6144:JnXOFxDkS6WtG6gGUgy9ZWHhnP9Ba5CfZomKKg7+uTAVg9EVJ0BVKvh82CYBuBNk:JRS6Wefq9Ba5oO7TUUk
Malware Config
Signatures
-
Processes:
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe -
Trickbot x86 loader 2 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/684-67-0x00000000008B0000-0x00000000008DB000-memory.dmp trickbot_loader32 behavioral1/memory/684-68-0x00000000008B0000-0x00000000008DB000-memory.dmp trickbot_loader32 -
Stops running service(s) 3 TTPs
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 912 sc.exe 992 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1340 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1340 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.execmd.execmd.execmd.exedescription pid process target process PID 684 wrote to memory of 1372 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1372 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1372 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1372 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1840 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1840 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1840 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1840 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1220 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1220 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1220 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 684 wrote to memory of 1220 684 6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe cmd.exe PID 1372 wrote to memory of 992 1372 cmd.exe sc.exe PID 1372 wrote to memory of 992 1372 cmd.exe sc.exe PID 1372 wrote to memory of 992 1372 cmd.exe sc.exe PID 1840 wrote to memory of 912 1840 cmd.exe sc.exe PID 1840 wrote to memory of 912 1840 cmd.exe sc.exe PID 1840 wrote to memory of 912 1840 cmd.exe sc.exe PID 1220 wrote to memory of 1340 1220 cmd.exe powershell.exe PID 1220 wrote to memory of 1340 1220 cmd.exe powershell.exe PID 1220 wrote to memory of 1340 1220 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe"C:\Users\Admin\AppData\Local\Temp\6c60b3c7f78328a56feda777b42491357ecc3c867c5decaee091df9e5238fb7f.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-68-0x00000000008B0000-0x00000000008DB000-memory.dmpFilesize
172KB
-
memory/684-67-0x00000000008B0000-0x00000000008DB000-memory.dmpFilesize
172KB
-
memory/684-54-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/912-59-0x0000000000000000-mapping.dmp
-
memory/992-58-0x0000000000000000-mapping.dmp
-
memory/1220-57-0x0000000000000000-mapping.dmp
-
memory/1340-60-0x0000000000000000-mapping.dmp
-
memory/1340-61-0x000007FEFB821000-0x000007FEFB823000-memory.dmpFilesize
8KB
-
memory/1340-62-0x000007FEF37D0000-0x000007FEF41F3000-memory.dmpFilesize
10.1MB
-
memory/1340-63-0x000007FEF2C70000-0x000007FEF37CD000-memory.dmpFilesize
11.4MB
-
memory/1340-64-0x0000000002394000-0x0000000002397000-memory.dmpFilesize
12KB
-
memory/1340-65-0x000000000239B000-0x00000000023BA000-memory.dmpFilesize
124KB
-
memory/1340-66-0x000000000239B000-0x00000000023BA000-memory.dmpFilesize
124KB
-
memory/1372-55-0x0000000000000000-mapping.dmp
-
memory/1840-56-0x0000000000000000-mapping.dmp