Analysis
-
max time kernel
106s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 20:51
Static task
static1
General
-
Target
2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe
-
Size
563KB
-
MD5
0b4733be6a1a345ddaa6f16700818207
-
SHA1
ba8227b7be68c6cd538aac70f4581c5087c9fbe5
-
SHA256
2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2
-
SHA512
e7d030b6f3ff2d5a6a5db6c6d2a374dcf77929822eee17895b190e3348d976ce085eb9ee60a913cf17cfa32a166f51d6f5c87efb0b076f63df05a931bba02b35
-
SSDEEP
12288:Jy904K0PcY+QzZNvPSgdSuWQpfhiH2AsCeiTKjb1Nf:Jyc0PcigHQppQ2xITKld
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it293701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it293701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it293701.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it293701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it293701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it293701.exe -
Executes dropped EXE 4 IoCs
pid Process 4664 zijZ2520.exe 980 it293701.exe 2996 kp369645.exe 3056 lr570289.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it293701.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zijZ2520.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zijZ2520.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1932 2996 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 980 it293701.exe 980 it293701.exe 2996 kp369645.exe 2996 kp369645.exe 3056 lr570289.exe 3056 lr570289.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 980 it293701.exe Token: SeDebugPrivilege 2996 kp369645.exe Token: SeDebugPrivilege 3056 lr570289.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3280 wrote to memory of 4664 3280 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe 82 PID 3280 wrote to memory of 4664 3280 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe 82 PID 3280 wrote to memory of 4664 3280 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe 82 PID 4664 wrote to memory of 980 4664 zijZ2520.exe 83 PID 4664 wrote to memory of 980 4664 zijZ2520.exe 83 PID 4664 wrote to memory of 2996 4664 zijZ2520.exe 85 PID 4664 wrote to memory of 2996 4664 zijZ2520.exe 85 PID 4664 wrote to memory of 2996 4664 zijZ2520.exe 85 PID 3280 wrote to memory of 3056 3280 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe 88 PID 3280 wrote to memory of 3056 3280 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe 88 PID 3280 wrote to memory of 3056 3280 2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe"C:\Users\Admin\AppData\Local\Temp\2f67808639d60a137df57d19a9592594ab5d6d2310641af21b07252a99cee2f2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijZ2520.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijZ2520.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it293701.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it293701.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp369645.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp369645.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 11564⤵
- Program crash
PID:1932
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr570289.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr570289.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2996 -ip 29961⤵PID:4896
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
409KB
MD557ed1067b836ec5295cf3e63258cfe7d
SHA116ce2697d1648f7d8a126362b93e22cc791a6d45
SHA256d5d816eab531e01598ec6b8cc91cda25d09dff1827a252c0cfe81486949fd6a7
SHA51255d9ec3323001b2dafe984dd5c315748e7b3a6b974c97ce1bd27888dfa65a86746c6502173acc509f07e6f93c03dbe43f130a176f88f7fd238c64be54a1df900
-
Filesize
409KB
MD557ed1067b836ec5295cf3e63258cfe7d
SHA116ce2697d1648f7d8a126362b93e22cc791a6d45
SHA256d5d816eab531e01598ec6b8cc91cda25d09dff1827a252c0cfe81486949fd6a7
SHA51255d9ec3323001b2dafe984dd5c315748e7b3a6b974c97ce1bd27888dfa65a86746c6502173acc509f07e6f93c03dbe43f130a176f88f7fd238c64be54a1df900
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
361KB
MD549f7737833ee991740dac64253f5c12f
SHA155ae0a769f55e08bdcd8027eef0365c35e3950f7
SHA256e29be92677167dce816e1c58bff6fc43e1fcf6421c0b8a713c7b4f0be93d7bf1
SHA512b259d012e9c621b21e6af84ea6f7cb6081a634a6415a92895e5c1872c49beda7c6519d9995b3d1faf4d96d46ea9088c77fa26e9f6725cb4d7f50308622903d18
-
Filesize
361KB
MD549f7737833ee991740dac64253f5c12f
SHA155ae0a769f55e08bdcd8027eef0365c35e3950f7
SHA256e29be92677167dce816e1c58bff6fc43e1fcf6421c0b8a713c7b4f0be93d7bf1
SHA512b259d012e9c621b21e6af84ea6f7cb6081a634a6415a92895e5c1872c49beda7c6519d9995b3d1faf4d96d46ea9088c77fa26e9f6725cb4d7f50308622903d18