Analysis
-
max time kernel
51s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/04/2023, 20:56
Static task
static1
General
-
Target
7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe
-
Size
564KB
-
MD5
217d28d46198efc189c4aff93d44286d
-
SHA1
aacacaf989f677086251376ef6b213db63a5d85c
-
SHA256
7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0
-
SHA512
d52b049d7907b53779d814fa35305a04bff637b27d97c8a25792b7d548a358d373c7d0758848b1e7705a19d8a6c43a87298f0f37397858d5735ad80e2c570c12
-
SSDEEP
12288:Vy90FwYV7TD50PxjJF2go6AhSH2yCCeiOKtkJhc:Vy/YV7H5mxjZd4g2JIOKb
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it712330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it712330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it712330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it712330.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it712330.exe -
Executes dropped EXE 4 IoCs
pid Process 2124 ziGu1622.exe 4016 it712330.exe 4868 kp275914.exe 1780 lr392186.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it712330.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziGu1622.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziGu1622.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4016 it712330.exe 4016 it712330.exe 4868 kp275914.exe 4868 kp275914.exe 1780 lr392186.exe 1780 lr392186.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4016 it712330.exe Token: SeDebugPrivilege 4868 kp275914.exe Token: SeDebugPrivilege 1780 lr392186.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5040 wrote to memory of 2124 5040 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe 66 PID 5040 wrote to memory of 2124 5040 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe 66 PID 5040 wrote to memory of 2124 5040 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe 66 PID 2124 wrote to memory of 4016 2124 ziGu1622.exe 67 PID 2124 wrote to memory of 4016 2124 ziGu1622.exe 67 PID 2124 wrote to memory of 4868 2124 ziGu1622.exe 68 PID 2124 wrote to memory of 4868 2124 ziGu1622.exe 68 PID 2124 wrote to memory of 4868 2124 ziGu1622.exe 68 PID 5040 wrote to memory of 1780 5040 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe 70 PID 5040 wrote to memory of 1780 5040 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe 70 PID 5040 wrote to memory of 1780 5040 7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe"C:\Users\Admin\AppData\Local\Temp\7bad535c3009a0633bfb06c65d7e6bb8d1a9da79c8bc3f6db3aab9f1e82751d0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGu1622.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziGu1622.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it712330.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it712330.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp275914.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp275914.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr392186.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr392186.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
409KB
MD56dcfef2d06f825e1cf8c4b8cd4a7556a
SHA1e56a89daad733f3ae8de4da197f312a67296162b
SHA2561ae56e29c34590a1e2f74fb32da08a76b7910f0afe2306defc6690585f9153e2
SHA5129451121fa787ff7fc1c060a65fad71e4686a846716225e65c0f1c1d00ede5574b3ec460e2416e2b8b2b25ffc9dc624e2900efdeff545bea5782ca8fc12015804
-
Filesize
409KB
MD56dcfef2d06f825e1cf8c4b8cd4a7556a
SHA1e56a89daad733f3ae8de4da197f312a67296162b
SHA2561ae56e29c34590a1e2f74fb32da08a76b7910f0afe2306defc6690585f9153e2
SHA5129451121fa787ff7fc1c060a65fad71e4686a846716225e65c0f1c1d00ede5574b3ec460e2416e2b8b2b25ffc9dc624e2900efdeff545bea5782ca8fc12015804
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
361KB
MD57f06093438dc1d959025d6ab2af5771b
SHA10868f61674dc9579db51dde0023457082fc86c64
SHA2567dfa3c183e8144fe4b68bf06aa2057a513ff2fa06df3904d34c365b4ac5df2d6
SHA5129a203be97e6c7a90315401bf91822eb2c4666b4a902e6fd4083db6bb463fc47edd33f0b0d8ffc6aef72435f50fc5bde230bad2b32a057baa2f086d3ddb236286
-
Filesize
361KB
MD57f06093438dc1d959025d6ab2af5771b
SHA10868f61674dc9579db51dde0023457082fc86c64
SHA2567dfa3c183e8144fe4b68bf06aa2057a513ff2fa06df3904d34c365b4ac5df2d6
SHA5129a203be97e6c7a90315401bf91822eb2c4666b4a902e6fd4083db6bb463fc47edd33f0b0d8ffc6aef72435f50fc5bde230bad2b32a057baa2f086d3ddb236286