Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 21:00
Static task
static1
General
-
Target
3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe
-
Size
704KB
-
MD5
eec562423dca90c4de4815e5d888d5df
-
SHA1
0b57a6f3c19939ba20f5fcdc9f4fc25145029670
-
SHA256
3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b
-
SHA512
4eb9101250f605b1c94398caaa0536484cd54658749256512eb3fdd0b22b7da3d0c5a90da07efc88852d1bee0a0074b6c98d7f3107b72f713cafc926b44ca24f
-
SSDEEP
12288:qy907xNg4N1AmBC67iMLS0YmRCYjgMWC0ixKg+aB2h5w:qyinx17BBWxEEAgpqxKSB2k
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr076136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr076136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr076136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr076136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr076136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr076136.exe -
Executes dropped EXE 4 IoCs
pid Process 2776 un502815.exe 2200 pr076136.exe 3144 qu381044.exe 5020 si563523.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr076136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr076136.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un502815.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un502815.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1324 2200 WerFault.exe 85 4660 3144 WerFault.exe 91 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2200 pr076136.exe 2200 pr076136.exe 3144 qu381044.exe 3144 qu381044.exe 5020 si563523.exe 5020 si563523.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2200 pr076136.exe Token: SeDebugPrivilege 3144 qu381044.exe Token: SeDebugPrivilege 5020 si563523.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 820 wrote to memory of 2776 820 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe 84 PID 820 wrote to memory of 2776 820 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe 84 PID 820 wrote to memory of 2776 820 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe 84 PID 2776 wrote to memory of 2200 2776 un502815.exe 85 PID 2776 wrote to memory of 2200 2776 un502815.exe 85 PID 2776 wrote to memory of 2200 2776 un502815.exe 85 PID 2776 wrote to memory of 3144 2776 un502815.exe 91 PID 2776 wrote to memory of 3144 2776 un502815.exe 91 PID 2776 wrote to memory of 3144 2776 un502815.exe 91 PID 820 wrote to memory of 5020 820 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe 94 PID 820 wrote to memory of 5020 820 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe 94 PID 820 wrote to memory of 5020 820 3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe"C:\Users\Admin\AppData\Local\Temp\3caf0f237ee60a64d3e6d7da62589cadb6dbd22fcf37677c70c865225894a30b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un502815.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un502815.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr076136.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr076136.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 10884⤵
- Program crash
PID:1324
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu381044.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu381044.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 13364⤵
- Program crash
PID:4660
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si563523.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si563523.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2200 -ip 22001⤵PID:2596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3144 -ip 31441⤵PID:1800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
550KB
MD5050d9060860d2e8e7a4eb289b627479e
SHA1757e45fb08cd03dae96cff055d79f6e6fdf14c6b
SHA256a24dcf0c4d18f67292b65c9b65cabc1796d6c1205fa7c52891c856e9ff0bb53d
SHA51276ea86ff8b9ee1f4320c14816d111c69ee9d9c3c949142b54be893d18fe22d59d1c2e38c3f8f1a5e4a4479eb4f1ff9f116c18efc6dc1679f6dd07198666f6f85
-
Filesize
550KB
MD5050d9060860d2e8e7a4eb289b627479e
SHA1757e45fb08cd03dae96cff055d79f6e6fdf14c6b
SHA256a24dcf0c4d18f67292b65c9b65cabc1796d6c1205fa7c52891c856e9ff0bb53d
SHA51276ea86ff8b9ee1f4320c14816d111c69ee9d9c3c949142b54be893d18fe22d59d1c2e38c3f8f1a5e4a4479eb4f1ff9f116c18efc6dc1679f6dd07198666f6f85
-
Filesize
277KB
MD574053d1416690bccb7a7f1be6dad5d3c
SHA1e2573a12a39c24c2ddcf917d7ce055f7c9fb17f7
SHA25658a840dab9859dcc875aeabd42defc0a3c4bdb95c80ef65b4be4f4b068a46c71
SHA512b13100dcc9584b965e7c4d8b6e811bca128919908246f4195bda63fc9a66948e22ad618579579fe20c797acf1423e3ad1453ed7909434b2c0f72000cc169529d
-
Filesize
277KB
MD574053d1416690bccb7a7f1be6dad5d3c
SHA1e2573a12a39c24c2ddcf917d7ce055f7c9fb17f7
SHA25658a840dab9859dcc875aeabd42defc0a3c4bdb95c80ef65b4be4f4b068a46c71
SHA512b13100dcc9584b965e7c4d8b6e811bca128919908246f4195bda63fc9a66948e22ad618579579fe20c797acf1423e3ad1453ed7909434b2c0f72000cc169529d
-
Filesize
361KB
MD514d33f6609b1257a63dc1ae0b34f6a25
SHA1568fec38983bd7697a139cd609cc8a2e029760ad
SHA256417603778236b838a2daf5e1f17caf829f0d0e5894b9d18f3e2e8b1584d96973
SHA5128fffd02cd608218e9b327db1eaf3de19467873741ca13296ef6cd49819b6e73bd605d2c3708a50a20727c2f9a3dc279d9e03849fa08a79daa4e32d05919c2c23
-
Filesize
361KB
MD514d33f6609b1257a63dc1ae0b34f6a25
SHA1568fec38983bd7697a139cd609cc8a2e029760ad
SHA256417603778236b838a2daf5e1f17caf829f0d0e5894b9d18f3e2e8b1584d96973
SHA5128fffd02cd608218e9b327db1eaf3de19467873741ca13296ef6cd49819b6e73bd605d2c3708a50a20727c2f9a3dc279d9e03849fa08a79daa4e32d05919c2c23