ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2

Analysis

max time kernel
157s
max time network
161s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/05/2023, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
Size

690KB
MD5

95d6bd9db91e5a888f096857155e04e3
SHA1

5d0628e45f71f1c0f30c5274eb67b97eed94045a
SHA256

ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2
SHA512

ee594767991063e81e4e4f42d80ed7868a67ae1a13d8e433bfb10fc9df87bd8a42115c318caae6f2fc9269165d3f9fc2875d153e15312c0f07f0733bdc63b19b
SSDEEP

12288:fy90rBazQF1SOM2hbDgVuXsIc/JxDnHcW9IN6Lmo:fykUEF1rMsslxDnHR9INJo

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	01530059.exe

Executes dropped EXE 3 IoCs

pid	Process
2008	un791441.exe
704	01530059.exe
1040	rk493197.exe

Loads dropped DLL 8 IoCs

pid	Process
1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
2008	un791441.exe
2008	un791441.exe
2008	un791441.exe
704	01530059.exe
2008	un791441.exe
2008	un791441.exe
1040	rk493197.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	01530059.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	01530059.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un791441.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un791441.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
704	01530059.exe
704	01530059.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	01530059.exe
Token: SeDebugPrivilege	1040	rk493197.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 1968 wrote to memory of 2008	1968	ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe	28
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 704	2008	un791441.exe	29
PID 2008 wrote to memory of 1040	2008	un791441.exe	30
PID 2008 wrote to memory of 1040	2008	un791441.exe	30
PID 2008 wrote to memory of 1040	2008	un791441.exe	30
PID 2008 wrote to memory of 1040	2008	un791441.exe	30
PID 2008 wrote to memory of 1040	2008	un791441.exe	30
PID 2008 wrote to memory of 1040	2008	un791441.exe	30
PID 2008 wrote to memory of 1040	2008	un791441.exe	30

C:\Users\Admin\AppData\Local\Temp\ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe
"C:\Users\Admin\AppData\Local\Temp\ede8488613c6627f6282e604ff461dc26a033631d00e42f3a51b588e16351da2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe

Filesize
536KB

MD5
1e8942042f4e3c88c6dc50c5438c4831

SHA1
f181724f534026834172dad3244b3e2dc2323ab3

SHA256
c774a7674888fbabc046951d4e9dd431443d04fbafa2c115f2bf60870e24fbbd

SHA512
7c8a220f8c60855d4e546d897173319aff3227313699f8c8420bed5b837f6859ca33d98af95e9a424fb86f4a238e57a39b75460a7a12746d4d03a5eb46f3b596

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe

Filesize
536KB

MD5
1e8942042f4e3c88c6dc50c5438c4831

SHA1
f181724f534026834172dad3244b3e2dc2323ab3

SHA256
c774a7674888fbabc046951d4e9dd431443d04fbafa2c115f2bf60870e24fbbd

SHA512
7c8a220f8c60855d4e546d897173319aff3227313699f8c8420bed5b837f6859ca33d98af95e9a424fb86f4a238e57a39b75460a7a12746d4d03a5eb46f3b596

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe

Filesize
536KB

MD5
1e8942042f4e3c88c6dc50c5438c4831

SHA1
f181724f534026834172dad3244b3e2dc2323ab3

SHA256
c774a7674888fbabc046951d4e9dd431443d04fbafa2c115f2bf60870e24fbbd

SHA512
7c8a220f8c60855d4e546d897173319aff3227313699f8c8420bed5b837f6859ca33d98af95e9a424fb86f4a238e57a39b75460a7a12746d4d03a5eb46f3b596

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un791441.exe

Filesize
536KB

MD5
1e8942042f4e3c88c6dc50c5438c4831

SHA1
f181724f534026834172dad3244b3e2dc2323ab3

SHA256
c774a7674888fbabc046951d4e9dd431443d04fbafa2c115f2bf60870e24fbbd

SHA512
7c8a220f8c60855d4e546d897173319aff3227313699f8c8420bed5b837f6859ca33d98af95e9a424fb86f4a238e57a39b75460a7a12746d4d03a5eb46f3b596

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\01530059.exe

Filesize
259KB

MD5
92b8e90be09de7712112a2d14f2bc111

SHA1
e3a3382fe29e90e089e8674c09c6d59d29d53c34

SHA256
c6f46f4b312e8dd28bd8b1c1d19a2ea5609870937af155355cd3d0c0f0b8e0f4

SHA512
b10e6183313fdf75436fa2d73c178ca450b677f20eaa8aeb48a7c936583de969af15735c85c895b3b51db9400180288c6b2f13e66e1ae863f76b316c3585ba14

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk493197.exe

Filesize
342KB

MD5
6f32d7d68c46c3b404c54be39f577a1f

SHA1
847f55260e22bee2b52e71fb8cc83583aeaff36f

SHA256
d6a2d7b5cccb14651b0f4f26d46c881e016890a0505c860774e4757f79a1d30d

SHA512
567caffdb24f19a3e7c2bbc0dd8f12b0644ca335a0323c40daa01defd74d0bf0c3e403d13d763c03f2e06ffa90b6f0fa11325c5c4722c767749d0d2daed49283

Download Submit
memory/704-111-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/704-89-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-91-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-93-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-95-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-97-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-99-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-101-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-103-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-105-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-107-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-110-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/704-109-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/704-108-0x0000000000460000-0x000000000048D000-memory.dmp

Filesize
180KB

Download
memory/704-87-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-114-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/704-85-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-83-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-81-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-80-0x0000000001FA0000-0x0000000001FB3000-memory.dmp

Filesize
76KB

Download
memory/704-79-0x0000000001FA0000-0x0000000001FB8000-memory.dmp

Filesize
96KB

Download
memory/704-78-0x0000000001E60000-0x0000000001E7A000-memory.dmp

Filesize
104KB

Download
memory/1040-126-0x00000000022D0000-0x000000000230A000-memory.dmp

Filesize
232KB

Download
memory/1040-147-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-127-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-130-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-128-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-132-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-138-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-136-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-140-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-134-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-142-0x0000000000240000-0x0000000000286000-memory.dmp

Filesize
280KB

Download
memory/1040-143-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-144-0x0000000004B00000-0x0000000004B40000-memory.dmp

Filesize
256KB

Download
memory/1040-125-0x0000000002290000-0x00000000022CC000-memory.dmp

Filesize
240KB

Download
memory/1040-146-0x0000000004B00000-0x0000000004B40000-memory.dmp

Filesize
256KB

Download
memory/1040-149-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-151-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-153-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-155-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-157-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-159-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-161-0x00000000022D0000-0x0000000002305000-memory.dmp

Filesize
212KB

Download
memory/1040-922-0x0000000004B00000-0x0000000004B40000-memory.dmp

Filesize
256KB

Download
memory/1040-924-0x0000000004B00000-0x0000000004B40000-memory.dmp

Filesize
256KB

Download
memory/1040-926-0x0000000004B00000-0x0000000004B40000-memory.dmp

Filesize
256KB

Download