bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7

Analysis

max time kernel
143s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
Size

746KB
MD5

32f8570e3a85e6223918d511ec015f7c
SHA1

0b1345f241a912cdbd240251c57671077300d76c
SHA256

bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7
SHA512

a1266b7ef27b13065e749ac75750d871a6375d5345140fa291876537795eda7716cd269a79133cf11dffda2c645a6425904e105b557cfd13d20258a9b234daef
SSDEEP

12288:by90Oz4F+rk0P5LThBoOaiYXZrSb/XTYb2AEQ3E/bKxnNR06Bl54TNPh0ZfTgt:bytVTYXo/X8rEOpNWugNP2hTgt

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	69182299.exe

Executes dropped EXE 3 IoCs

pid	Process
924	un467407.exe
572	69182299.exe
852	rk403627.exe

Loads dropped DLL 8 IoCs

pid	Process
1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
924	un467407.exe
924	un467407.exe
924	un467407.exe
572	69182299.exe
924	un467407.exe
924	un467407.exe
852	rk403627.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	69182299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	69182299.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un467407.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un467407.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
572	69182299.exe
572	69182299.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	572	69182299.exe
Token: SeDebugPrivilege	852	rk403627.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 1344 wrote to memory of 924	1344	bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe	27
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 572	924	un467407.exe	28
PID 924 wrote to memory of 852	924	un467407.exe	29
PID 924 wrote to memory of 852	924	un467407.exe	29
PID 924 wrote to memory of 852	924	un467407.exe	29
PID 924 wrote to memory of 852	924	un467407.exe	29
PID 924 wrote to memory of 852	924	un467407.exe	29
PID 924 wrote to memory of 852	924	un467407.exe	29
PID 924 wrote to memory of 852	924	un467407.exe	29

C:\Users\Admin\AppData\Local\Temp\bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe
"C:\Users\Admin\AppData\Local\Temp\bd483f5eafa76555565d81818985a5553e020a9a186c7f49957914eb9cbbded7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe

Filesize
592KB

MD5
0dae66ec6c3df5fa25e3fb7a5f57c974

SHA1
60265342159a907ebd296107d5fc48b4965b3bfb

SHA256
a45497d7841edc943650f305776c094b9352db45ce2d86eed01c432cbe82cea8

SHA512
ff2363fab4184f766c665fe2426f9574604ca471cb5a628fb4e93348b3bb82cf4c1d6371bbc62b17c5f0b049f14c9fbc6d2cb9e92ec797732fc0039369cd752c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe

Filesize
592KB

MD5
0dae66ec6c3df5fa25e3fb7a5f57c974

SHA1
60265342159a907ebd296107d5fc48b4965b3bfb

SHA256
a45497d7841edc943650f305776c094b9352db45ce2d86eed01c432cbe82cea8

SHA512
ff2363fab4184f766c665fe2426f9574604ca471cb5a628fb4e93348b3bb82cf4c1d6371bbc62b17c5f0b049f14c9fbc6d2cb9e92ec797732fc0039369cd752c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe

Filesize
592KB

MD5
0dae66ec6c3df5fa25e3fb7a5f57c974

SHA1
60265342159a907ebd296107d5fc48b4965b3bfb

SHA256
a45497d7841edc943650f305776c094b9352db45ce2d86eed01c432cbe82cea8

SHA512
ff2363fab4184f766c665fe2426f9574604ca471cb5a628fb4e93348b3bb82cf4c1d6371bbc62b17c5f0b049f14c9fbc6d2cb9e92ec797732fc0039369cd752c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un467407.exe

Filesize
592KB

MD5
0dae66ec6c3df5fa25e3fb7a5f57c974

SHA1
60265342159a907ebd296107d5fc48b4965b3bfb

SHA256
a45497d7841edc943650f305776c094b9352db45ce2d86eed01c432cbe82cea8

SHA512
ff2363fab4184f766c665fe2426f9574604ca471cb5a628fb4e93348b3bb82cf4c1d6371bbc62b17c5f0b049f14c9fbc6d2cb9e92ec797732fc0039369cd752c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\69182299.exe

Filesize
377KB

MD5
f6007bf5d4fabc3c1615a4608c0fa57b

SHA1
565ba5b7fdc67cbefea85a91711dd8e66cfeda61

SHA256
988fd457ee58a8190a0797e83399bd28867fe9883c27859e9bb4e5039f84de10

SHA512
2501d3ef7071ab8704032041558806397019145554bba2188d443eac9c25064eabb9d20e46e156ec9c5924bfaa54b63d876136a14ac4b4b2d2330a5d9ddbb135

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk403627.exe

Filesize
459KB

MD5
fcc1b2abda0ffbbaecc5e76cbd94b1db

SHA1
cc0d65f0a37f46cff47163d0d56ce33f768317a9

SHA256
0e6950ad0fda46a892c272c8f1144867a99a474d16418ba91a3b957c000af9ca

SHA512
af217b09fb96cc64fd6517677b7f1ebd324fa406a6db500c166d7df6dc54a8d0c7838ab5598d5b6e20c2c5822b7ad9078fe0c443a48b36d4c6f1f588a6021196

Download Submit
memory/572-113-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/572-78-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/572-91-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-93-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-95-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-97-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-99-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-101-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-103-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-105-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-107-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-110-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/572-109-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/572-108-0x0000000000250000-0x000000000027D000-memory.dmp

Filesize
180KB

Download
memory/572-111-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/572-112-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/572-87-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-115-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/572-85-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-83-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-81-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-80-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/572-79-0x00000000008A0000-0x00000000008B8000-memory.dmp

Filesize
96KB

Download
memory/572-89-0x00000000008A0000-0x00000000008B2000-memory.dmp

Filesize
72KB

Download
memory/852-147-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-135-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-128-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-129-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-131-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-133-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-145-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-137-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-139-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-141-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-127-0x00000000029A0000-0x00000000029DA000-memory.dmp

Filesize
232KB

Download
memory/852-143-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-155-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-149-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-151-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-153-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-126-0x0000000002960000-0x000000000299C000-memory.dmp

Filesize
240KB

Download
memory/852-159-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-157-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/852-458-0x0000000000240000-0x0000000000286000-memory.dmp

Filesize
280KB

Download
memory/852-460-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download
memory/852-922-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download
memory/852-924-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download
memory/852-925-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download