Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 21:06
Static task
static1
General
-
Target
bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe
-
Size
563KB
-
MD5
8e0d1468c1cd7f3577f19bc81c5ac6f7
-
SHA1
6446cb8e9b688224dde2869e5a59fdd4a7f3230b
-
SHA256
bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13
-
SHA512
d0b296731a13f055d32883068fa611944680ba5f37de8d030a614e60ee84d48f8519988ff921d29fab17d224a2c6024b645f3d967dbd6fc61bc698ea4405e446
-
SSDEEP
12288:xy90OgClWtONpZpulIwUzR0mQTMCBF6rtKMtu+RV:xyrgClwONpDUAamQTRBEwgu+RV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it284374.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it284374.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it284374.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it284374.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it284374.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it284374.exe -
Executes dropped EXE 4 IoCs
pid Process 4344 ziYM3635.exe 1092 it284374.exe 2040 kp507224.exe 3668 lr349908.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it284374.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziYM3635.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziYM3635.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4104 sc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4528 2040 WerFault.exe 88 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1092 it284374.exe 1092 it284374.exe 2040 kp507224.exe 2040 kp507224.exe 3668 lr349908.exe 3668 lr349908.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1092 it284374.exe Token: SeDebugPrivilege 2040 kp507224.exe Token: SeDebugPrivilege 3668 lr349908.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4828 wrote to memory of 4344 4828 bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe 83 PID 4828 wrote to memory of 4344 4828 bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe 83 PID 4828 wrote to memory of 4344 4828 bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe 83 PID 4344 wrote to memory of 1092 4344 ziYM3635.exe 84 PID 4344 wrote to memory of 1092 4344 ziYM3635.exe 84 PID 4344 wrote to memory of 2040 4344 ziYM3635.exe 88 PID 4344 wrote to memory of 2040 4344 ziYM3635.exe 88 PID 4344 wrote to memory of 2040 4344 ziYM3635.exe 88 PID 4828 wrote to memory of 3668 4828 bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe 91 PID 4828 wrote to memory of 3668 4828 bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe 91 PID 4828 wrote to memory of 3668 4828 bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe"C:\Users\Admin\AppData\Local\Temp\bd6179ef1c5409ba4e708bc28d871d7e0870588f908b9aeb7489238098c63f13.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYM3635.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYM3635.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it284374.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it284374.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp507224.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp507224.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 13364⤵
- Program crash
PID:4528
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr349908.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr349908.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2040 -ip 20401⤵PID:3548
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:4104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
409KB
MD5ed51bd8586405e030c4405ce990ed597
SHA184cff63a7b27f9a4916b2a6cf46489395e48b73a
SHA256746c85d0c09bc1a73acd71ecedf434e7bb051a1b2341dc6f5528d4ad0f7003b1
SHA51237a6b3fff36ef5875671881e155b22d3b6a22580cb4907c004086a041b15c134a918bcb2f04ff51994997c9880e1e8107ed067a77229cc32e92493557bbe0531
-
Filesize
409KB
MD5ed51bd8586405e030c4405ce990ed597
SHA184cff63a7b27f9a4916b2a6cf46489395e48b73a
SHA256746c85d0c09bc1a73acd71ecedf434e7bb051a1b2341dc6f5528d4ad0f7003b1
SHA51237a6b3fff36ef5875671881e155b22d3b6a22580cb4907c004086a041b15c134a918bcb2f04ff51994997c9880e1e8107ed067a77229cc32e92493557bbe0531
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
361KB
MD5850f525ecb2d9ea52cb706e539951562
SHA15e74c7cfcb5afa19ce2c13c387ae2f7b0cc02d8f
SHA256f1858ddaf804b89311f16f8be59c8c64fe3f6e64449014333f3fbfc63d9a1fd9
SHA512f4f211f9487ac0a85c60dcf954b7ae7f19d7ced36543b632fc7d6110beb39687df3716bf1ec797588505727f16947be6dde4e5e23d3a6f2756f63aa6f76eacf2
-
Filesize
361KB
MD5850f525ecb2d9ea52cb706e539951562
SHA15e74c7cfcb5afa19ce2c13c387ae2f7b0cc02d8f
SHA256f1858ddaf804b89311f16f8be59c8c64fe3f6e64449014333f3fbfc63d9a1fd9
SHA512f4f211f9487ac0a85c60dcf954b7ae7f19d7ced36543b632fc7d6110beb39687df3716bf1ec797588505727f16947be6dde4e5e23d3a6f2756f63aa6f76eacf2