e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192

Analysis

max time kernel
151s
max time network
189s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/05/2023, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe
Size

694KB
MD5

350833d78e9db8d00bdfa6761a37b3fc
SHA1

6028a30702af762ba2eac5a09e082b6b4769dbdd
SHA256

e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192
SHA512

fb17351992022e8f50ab15185591c78d4d3b3942adb776a6f087aaff55dcea1322895fba7d7456db94cc15215c85f71cd68ebcd9520cd83d91b0000de7ca0667
SSDEEP

12288:ly90z+lRbd1CkIzfNnTiRqlniqVdUN0cR/bP5zBjPJBWWrh:lyqwWkMfNWRqlRdUeYbRBTh

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	18709478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	18709478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	18709478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	18709478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	18709478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	18709478.exe

Executes dropped EXE 3 IoCs

pid	Process
1980	un181759.exe
1348	18709478.exe
1560	rk263891.exe

Loads dropped DLL 8 IoCs

pid	Process
860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe
1980	un181759.exe
1980	un181759.exe
1980	un181759.exe
1348	18709478.exe
1980	un181759.exe
1980	un181759.exe
1560	rk263891.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	18709478.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	18709478.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un181759.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un181759.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1348	18709478.exe
1348	18709478.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	18709478.exe
Token: SeDebugPrivilege	1560	rk263891.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 860 wrote to memory of 1980	860	e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe	28
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1348	1980	un181759.exe	29
PID 1980 wrote to memory of 1560	1980	un181759.exe	30
PID 1980 wrote to memory of 1560	1980	un181759.exe	30
PID 1980 wrote to memory of 1560	1980	un181759.exe	30
PID 1980 wrote to memory of 1560	1980	un181759.exe	30
PID 1980 wrote to memory of 1560	1980	un181759.exe	30
PID 1980 wrote to memory of 1560	1980	un181759.exe	30
PID 1980 wrote to memory of 1560	1980	un181759.exe	30

C:\Users\Admin\AppData\Local\Temp\e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe
"C:\Users\Admin\AppData\Local\Temp\e9a9f5900e3db922068e24197e4fe4462c1df8ff184bc662bc4eedc846383192.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181759.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181759.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181759.exe

Filesize
540KB

MD5
e22d9cca9707e68c58e0249fc5ca1730

SHA1
68749f886565be36c6d5964b35707b6f1626d21d

SHA256
f9d67f943a4731803176e24167ddeb18a27be9b6fefb58eadf59c04e7d2cfc75

SHA512
803e5cba7cc0c3b8f4e4403b4b37b00ef88ccd26d5f69006cb1ce76d1a44442678c6f59a4de9b768108609d13f7d98094d7d08bd36dc787764647940d1104736

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181759.exe

Filesize
540KB

MD5
e22d9cca9707e68c58e0249fc5ca1730

SHA1
68749f886565be36c6d5964b35707b6f1626d21d

SHA256
f9d67f943a4731803176e24167ddeb18a27be9b6fefb58eadf59c04e7d2cfc75

SHA512
803e5cba7cc0c3b8f4e4403b4b37b00ef88ccd26d5f69006cb1ce76d1a44442678c6f59a4de9b768108609d13f7d98094d7d08bd36dc787764647940d1104736

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe

Filesize
258KB

MD5
511ebe091c92581b0be0d6166af6be51

SHA1
f8a143ec994fb42e5fce49bdc92a8258f25b20d0

SHA256
dbdeda317f1238a7ce1086898076f93ecc418159b70f5f1e9fc5697fe51f73af

SHA512
119e9d99173b2547d1b12e6ab8391c25ca9c7572fa3e80fcbdf74d47c26f755dd69cafa29486343d591598c18e7d859eb2ceebd1b2ac6e2c1a4cac52667e3a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe

Filesize
258KB

MD5
511ebe091c92581b0be0d6166af6be51

SHA1
f8a143ec994fb42e5fce49bdc92a8258f25b20d0

SHA256
dbdeda317f1238a7ce1086898076f93ecc418159b70f5f1e9fc5697fe51f73af

SHA512
119e9d99173b2547d1b12e6ab8391c25ca9c7572fa3e80fcbdf74d47c26f755dd69cafa29486343d591598c18e7d859eb2ceebd1b2ac6e2c1a4cac52667e3a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe

Filesize
258KB

MD5
511ebe091c92581b0be0d6166af6be51

SHA1
f8a143ec994fb42e5fce49bdc92a8258f25b20d0

SHA256
dbdeda317f1238a7ce1086898076f93ecc418159b70f5f1e9fc5697fe51f73af

SHA512
119e9d99173b2547d1b12e6ab8391c25ca9c7572fa3e80fcbdf74d47c26f755dd69cafa29486343d591598c18e7d859eb2ceebd1b2ac6e2c1a4cac52667e3a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe

Filesize
341KB

MD5
8ecd2d96f80a98d6e7bb2cca69f72604

SHA1
cba3cfc3f264e9bc9a35129118366f7a2525ad2f

SHA256
88c35f3970b0a8be24d6f8698d01bf60444051ea65fd6f0296eb4b47667cdc19

SHA512
7952c58391530da86679732a79984e926c1e79ceab3ce54f0caf60eff92af489a86c71ff51f66e859bf8f96898944e845b286a6a2c7a8b47f719ce5ddfd00b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe

Filesize
341KB

MD5
8ecd2d96f80a98d6e7bb2cca69f72604

SHA1
cba3cfc3f264e9bc9a35129118366f7a2525ad2f

SHA256
88c35f3970b0a8be24d6f8698d01bf60444051ea65fd6f0296eb4b47667cdc19

SHA512
7952c58391530da86679732a79984e926c1e79ceab3ce54f0caf60eff92af489a86c71ff51f66e859bf8f96898944e845b286a6a2c7a8b47f719ce5ddfd00b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe

Filesize
341KB

MD5
8ecd2d96f80a98d6e7bb2cca69f72604

SHA1
cba3cfc3f264e9bc9a35129118366f7a2525ad2f

SHA256
88c35f3970b0a8be24d6f8698d01bf60444051ea65fd6f0296eb4b47667cdc19

SHA512
7952c58391530da86679732a79984e926c1e79ceab3ce54f0caf60eff92af489a86c71ff51f66e859bf8f96898944e845b286a6a2c7a8b47f719ce5ddfd00b0d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181759.exe

Filesize
540KB

MD5
e22d9cca9707e68c58e0249fc5ca1730

SHA1
68749f886565be36c6d5964b35707b6f1626d21d

SHA256
f9d67f943a4731803176e24167ddeb18a27be9b6fefb58eadf59c04e7d2cfc75

SHA512
803e5cba7cc0c3b8f4e4403b4b37b00ef88ccd26d5f69006cb1ce76d1a44442678c6f59a4de9b768108609d13f7d98094d7d08bd36dc787764647940d1104736

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181759.exe

Filesize
540KB

MD5
e22d9cca9707e68c58e0249fc5ca1730

SHA1
68749f886565be36c6d5964b35707b6f1626d21d

SHA256
f9d67f943a4731803176e24167ddeb18a27be9b6fefb58eadf59c04e7d2cfc75

SHA512
803e5cba7cc0c3b8f4e4403b4b37b00ef88ccd26d5f69006cb1ce76d1a44442678c6f59a4de9b768108609d13f7d98094d7d08bd36dc787764647940d1104736

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe

Filesize
258KB

MD5
511ebe091c92581b0be0d6166af6be51

SHA1
f8a143ec994fb42e5fce49bdc92a8258f25b20d0

SHA256
dbdeda317f1238a7ce1086898076f93ecc418159b70f5f1e9fc5697fe51f73af

SHA512
119e9d99173b2547d1b12e6ab8391c25ca9c7572fa3e80fcbdf74d47c26f755dd69cafa29486343d591598c18e7d859eb2ceebd1b2ac6e2c1a4cac52667e3a90

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe

Filesize
258KB

MD5
511ebe091c92581b0be0d6166af6be51

SHA1
f8a143ec994fb42e5fce49bdc92a8258f25b20d0

SHA256
dbdeda317f1238a7ce1086898076f93ecc418159b70f5f1e9fc5697fe51f73af

SHA512
119e9d99173b2547d1b12e6ab8391c25ca9c7572fa3e80fcbdf74d47c26f755dd69cafa29486343d591598c18e7d859eb2ceebd1b2ac6e2c1a4cac52667e3a90

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\18709478.exe

Filesize
258KB

MD5
511ebe091c92581b0be0d6166af6be51

SHA1
f8a143ec994fb42e5fce49bdc92a8258f25b20d0

SHA256
dbdeda317f1238a7ce1086898076f93ecc418159b70f5f1e9fc5697fe51f73af

SHA512
119e9d99173b2547d1b12e6ab8391c25ca9c7572fa3e80fcbdf74d47c26f755dd69cafa29486343d591598c18e7d859eb2ceebd1b2ac6e2c1a4cac52667e3a90

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe

Filesize
341KB

MD5
8ecd2d96f80a98d6e7bb2cca69f72604

SHA1
cba3cfc3f264e9bc9a35129118366f7a2525ad2f

SHA256
88c35f3970b0a8be24d6f8698d01bf60444051ea65fd6f0296eb4b47667cdc19

SHA512
7952c58391530da86679732a79984e926c1e79ceab3ce54f0caf60eff92af489a86c71ff51f66e859bf8f96898944e845b286a6a2c7a8b47f719ce5ddfd00b0d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe

Filesize
341KB

MD5
8ecd2d96f80a98d6e7bb2cca69f72604

SHA1
cba3cfc3f264e9bc9a35129118366f7a2525ad2f

SHA256
88c35f3970b0a8be24d6f8698d01bf60444051ea65fd6f0296eb4b47667cdc19

SHA512
7952c58391530da86679732a79984e926c1e79ceab3ce54f0caf60eff92af489a86c71ff51f66e859bf8f96898944e845b286a6a2c7a8b47f719ce5ddfd00b0d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk263891.exe

Filesize
341KB

MD5
8ecd2d96f80a98d6e7bb2cca69f72604

SHA1
cba3cfc3f264e9bc9a35129118366f7a2525ad2f

SHA256
88c35f3970b0a8be24d6f8698d01bf60444051ea65fd6f0296eb4b47667cdc19

SHA512
7952c58391530da86679732a79984e926c1e79ceab3ce54f0caf60eff92af489a86c71ff51f66e859bf8f96898944e845b286a6a2c7a8b47f719ce5ddfd00b0d

Download Submit
memory/1348-108-0x00000000003D0000-0x00000000003FD000-memory.dmp

Filesize
180KB

Download
memory/1348-89-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-91-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-93-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-95-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-97-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-99-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-101-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-103-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-105-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-107-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-109-0x0000000007130000-0x0000000007170000-memory.dmp

Filesize
256KB

Download
memory/1348-87-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-110-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/1348-114-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/1348-85-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-83-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-81-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-80-0x0000000002D00000-0x0000000002D13000-memory.dmp

Filesize
76KB

Download
memory/1348-79-0x0000000002D00000-0x0000000002D18000-memory.dmp

Filesize
96KB

Download
memory/1348-78-0x0000000002CB0000-0x0000000002CCA000-memory.dmp

Filesize
104KB

Download
memory/1560-125-0x0000000002E80000-0x0000000002EBC000-memory.dmp

Filesize
240KB

Download
memory/1560-126-0x0000000002EC0000-0x0000000002EFA000-memory.dmp

Filesize
232KB

Download
memory/1560-128-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-130-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-132-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-129-0x00000000073B0000-0x00000000073F0000-memory.dmp

Filesize
256KB

Download
memory/1560-127-0x00000000002C0000-0x0000000000306000-memory.dmp

Filesize
280KB

Download
memory/1560-134-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-136-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-138-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-140-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-142-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-144-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-146-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-148-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-150-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-152-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-154-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-156-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-158-0x0000000002EC0000-0x0000000002EF5000-memory.dmp

Filesize
212KB

Download
memory/1560-922-0x00000000073B0000-0x00000000073F0000-memory.dmp

Filesize
256KB

Download
memory/1560-925-0x00000000073B0000-0x00000000073F0000-memory.dmp

Filesize
256KB

Download