fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93

Analysis

max time kernel
219s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2023 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe
Size

1.5MB
MD5

79dc2c07b53d511ba1e0e8cd6edd7784
SHA1

df2cd1754cceba5d02343ccfe0caf155d1784e01
SHA256

fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93
SHA512

c8b51056fd7ce6c63b18172ffd1c01b6fad8beeee07e82e950d9810158cde2162bedfa45541d5328202223b88c54037f22d6a2f68e3a8ca5ed0ad28fc286cdd9
SSDEEP

24576:2y0atV1/TKY6IxLrmBUwcSiKt+cvTsyMVX5Jcvb5c0zGs2ZcJXq1/kbkcRcTTfin:FLtV5KYqdcSvtdvT/MTWvbFSYJXq1YkW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	42146821.exe

Executes dropped EXE 6 IoCs

pid	Process
456	za458616.exe
3800	za818746.exe
4212	za897255.exe
324	42146821.exe
2204	1.exe
1492	u31822992.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	za818746.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za897255.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	za897255.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za458616.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	za458616.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za818746.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	1492	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	1.exe
2204	1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	324	42146821.exe
Token: SeDebugPrivilege	1492	u31822992.exe
Token: SeDebugPrivilege	2204	1.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 456	4164	fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe	79
PID 4164 wrote to memory of 456	4164	fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe	79
PID 4164 wrote to memory of 456	4164	fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe	79
PID 456 wrote to memory of 3800	456	za458616.exe	80
PID 456 wrote to memory of 3800	456	za458616.exe	80
PID 456 wrote to memory of 3800	456	za458616.exe	80
PID 3800 wrote to memory of 4212	3800	za818746.exe	81
PID 3800 wrote to memory of 4212	3800	za818746.exe	81
PID 3800 wrote to memory of 4212	3800	za818746.exe	81
PID 4212 wrote to memory of 324	4212	za897255.exe	82
PID 4212 wrote to memory of 324	4212	za897255.exe	82
PID 4212 wrote to memory of 324	4212	za897255.exe	82
PID 324 wrote to memory of 2204	324	42146821.exe	84
PID 324 wrote to memory of 2204	324	42146821.exe	84
PID 4212 wrote to memory of 1492	4212	za897255.exe	85
PID 4212 wrote to memory of 1492	4212	za897255.exe	85
PID 4212 wrote to memory of 1492	4212	za897255.exe	85

C:\Users\Admin\AppData\Local\Temp\fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe
"C:\Users\Admin\AppData\Local\Temp\fc45ef1987e6f93441456af2d2278471ca8ea98ce91ad7c9f7c7a1ac6ac15d93.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za458616.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za458616.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za818746.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za818746.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897255.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897255.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\42146821.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\42146821.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:324
      - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u31822992.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u31822992.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1228
        6⤵
        Program crash
        
        PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1492 -ip 1492
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za458616.exe

Filesize
1.3MB

MD5
4a53177964d1e8b5ab2513397247db71

SHA1
3a76e5c58663d39c85b8d1d7ee090070a25e53a6

SHA256
3877dd4ace3fcfec12b25ea3e6d564c90266a313add16e23f9e5786b0420ab73

SHA512
c4f946241fc2810fa1973f4431f2fac0c606caa3acfab97185bcb39c4b497921be59af938edeea279760713707c9c95422c75b6a3ab41a42555c96b29e012943

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za458616.exe

Filesize
1.3MB

MD5
4a53177964d1e8b5ab2513397247db71

SHA1
3a76e5c58663d39c85b8d1d7ee090070a25e53a6

SHA256
3877dd4ace3fcfec12b25ea3e6d564c90266a313add16e23f9e5786b0420ab73

SHA512
c4f946241fc2810fa1973f4431f2fac0c606caa3acfab97185bcb39c4b497921be59af938edeea279760713707c9c95422c75b6a3ab41a42555c96b29e012943

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za818746.exe

Filesize
862KB

MD5
485f2c2a1b7c348e067dd5c8e8fdcf8c

SHA1
8d132463a6723a43aa780c4d01244eea0121aa30

SHA256
7dc3f7ff7869a199ab712b96016df498856f27aa15039d3450966f083d4b1d47

SHA512
261182769e2fa93d5e6538d6f32462a9c6cb7751b3bc96eb6ef7a3e895e7fe8d88d37e1ea67d96f0215d81d57b85d8b65051a27a621a8305bebada7f9191e41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za818746.exe

Filesize
862KB

MD5
485f2c2a1b7c348e067dd5c8e8fdcf8c

SHA1
8d132463a6723a43aa780c4d01244eea0121aa30

SHA256
7dc3f7ff7869a199ab712b96016df498856f27aa15039d3450966f083d4b1d47

SHA512
261182769e2fa93d5e6538d6f32462a9c6cb7751b3bc96eb6ef7a3e895e7fe8d88d37e1ea67d96f0215d81d57b85d8b65051a27a621a8305bebada7f9191e41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897255.exe

Filesize
679KB

MD5
1816163806af18cc9e18cbf1d639aa5a

SHA1
50b7a3b7c6440187a276fb812e078806fd537a33

SHA256
ab6c67aa32df091f01f33aa8ec4f6f48f095dbc71c7674a79961bc25c0aac022

SHA512
e3bcd7fa35f0f1b2b58385984407de50e486232fc471010fb3171772252b786996edebb2835e746b443bd5be1fa81c538678a0d158448e620bae02392e1a7b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za897255.exe

Filesize
679KB

MD5
1816163806af18cc9e18cbf1d639aa5a

SHA1
50b7a3b7c6440187a276fb812e078806fd537a33

SHA256
ab6c67aa32df091f01f33aa8ec4f6f48f095dbc71c7674a79961bc25c0aac022

SHA512
e3bcd7fa35f0f1b2b58385984407de50e486232fc471010fb3171772252b786996edebb2835e746b443bd5be1fa81c538678a0d158448e620bae02392e1a7b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\42146821.exe

Filesize
301KB

MD5
886b0d45d9ce0e764d05fec98387ff3f

SHA1
be57b6b11b436294fe57d5027489d796479ed395

SHA256
44c2da415944fb2179e573928288ad25b28dc33b84c5e9a557178b4f4b16fe58

SHA512
8ee0f6b36efe2b3dd784f068371521a506b4e0595a656511142d2686008ebc51c72156792a38d5147360c69cda1f45bca0560c3021ac894b0821000d9a7abf45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\42146821.exe

Filesize
301KB

MD5
886b0d45d9ce0e764d05fec98387ff3f

SHA1
be57b6b11b436294fe57d5027489d796479ed395

SHA256
44c2da415944fb2179e573928288ad25b28dc33b84c5e9a557178b4f4b16fe58

SHA512
8ee0f6b36efe2b3dd784f068371521a506b4e0595a656511142d2686008ebc51c72156792a38d5147360c69cda1f45bca0560c3021ac894b0821000d9a7abf45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u31822992.exe

Filesize
522KB

MD5
8a4000c09c6fc7433f6bbaccd7b01547

SHA1
ca6cbfe78eee29295e008d48d4d800ec49af3d15

SHA256
36c0ce103da36c8e65d2d1c6cac46e26851bef2df233125ffeb3df6984279a91

SHA512
1bf6b13df279e07b5c1eea7cc55e62184eeb7f9f34c3bcb7f00574d405d37d21ad12f34aa92d6b4717e1c21e2574b2d10d4bb9d95497161e935bc8823987cb86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u31822992.exe

Filesize
522KB

MD5
8a4000c09c6fc7433f6bbaccd7b01547

SHA1
ca6cbfe78eee29295e008d48d4d800ec49af3d15

SHA256
36c0ce103da36c8e65d2d1c6cac46e26851bef2df233125ffeb3df6984279a91

SHA512
1bf6b13df279e07b5c1eea7cc55e62184eeb7f9f34c3bcb7f00574d405d37d21ad12f34aa92d6b4717e1c21e2574b2d10d4bb9d95497161e935bc8823987cb86

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/324-171-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-215-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-165-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-173-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-175-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-177-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-179-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-181-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-183-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-185-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-187-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-189-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-191-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-193-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-195-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-197-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-199-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-201-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-203-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-205-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-207-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-209-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-211-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-169-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-213-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-217-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-219-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-221-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-223-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-225-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-227-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-167-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-164-0x0000000004F70000-0x0000000004FC1000-memory.dmp

Filesize
324KB

Download
memory/324-163-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/324-2304-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/324-162-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/324-161-0x00000000049A0000-0x0000000004F44000-memory.dmp

Filesize
5.6MB

Download
memory/1492-2310-0x0000000000A00000-0x0000000000A4C000-memory.dmp

Filesize
304KB

Download
memory/1492-2578-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-2576-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-4443-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-4444-0x0000000000A00000-0x0000000000A4C000-memory.dmp

Filesize
304KB

Download
memory/1492-4445-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-4446-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-4447-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-4449-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1492-4452-0x0000000005AF0000-0x0000000005B82000-memory.dmp

Filesize
584KB

Download
memory/2204-2308-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download