d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe
Size

697KB
MD5

c6cffa513a9f7eaab59a15c8595e276c
SHA1

952b4069097235d093c3f4a5f91735017bac7811
SHA256

d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9
SHA512

b1e96465b65a79f482a69d58544cecd355aebc32903c9c6d0cc9c72050fad2208241e740d0049f238a50fb0572abf6d79f27fce6c33878d8f3634a25f26b599a
SSDEEP

12288:sy90jkqwaRC8pmGmnXQxywvAjeZjxz9Bm2cJNIE2V7tNHSWa1c6k:symsawTGmXQxyLAjM2uS/Rh8c6k

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	79626243.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	79626243.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	79626243.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	79626243.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	79626243.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	79626243.exe

Executes dropped EXE 3 IoCs

pid	Process
1624	un855735.exe
468	79626243.exe
744	rk346782.exe

Loads dropped DLL 8 IoCs

pid	Process
1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe
1624	un855735.exe
1624	un855735.exe
1624	un855735.exe
468	79626243.exe
1624	un855735.exe
1624	un855735.exe
744	rk346782.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	79626243.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	79626243.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un855735.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un855735.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	79626243.exe
468	79626243.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	79626243.exe
Token: SeDebugPrivilege	744	rk346782.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1172 wrote to memory of 1624	1172	d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe	27
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 468	1624	un855735.exe	28
PID 1624 wrote to memory of 744	1624	un855735.exe	29
PID 1624 wrote to memory of 744	1624	un855735.exe	29
PID 1624 wrote to memory of 744	1624	un855735.exe	29
PID 1624 wrote to memory of 744	1624	un855735.exe	29
PID 1624 wrote to memory of 744	1624	un855735.exe	29
PID 1624 wrote to memory of 744	1624	un855735.exe	29
PID 1624 wrote to memory of 744	1624	un855735.exe	29

C:\Users\Admin\AppData\Local\Temp\d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe
"C:\Users\Admin\AppData\Local\Temp\d0aa3df71a9943907e9ef016c47d2133690c60c0f8323518bd779c0802577cb9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un855735.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un855735.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un855735.exe

Filesize
543KB

MD5
392265fa634ad111c20ce760b126c045

SHA1
e83f0ea66f6f56b2fafb9d1bd6ba5c2de7843b9b

SHA256
cdf0980b713c33a34fdbabe794727ffae99d8b9f35426342565f51c491bd2cbf

SHA512
bc5b1ec2403768a0de3d321d9cc82abd3c80da7e74f6fd1a751c53f7415628c4194bcb613e7b60bc250401e76bd2ad779999cc3d6ce70b39cbc496af302ae178

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un855735.exe

Filesize
543KB

MD5
392265fa634ad111c20ce760b126c045

SHA1
e83f0ea66f6f56b2fafb9d1bd6ba5c2de7843b9b

SHA256
cdf0980b713c33a34fdbabe794727ffae99d8b9f35426342565f51c491bd2cbf

SHA512
bc5b1ec2403768a0de3d321d9cc82abd3c80da7e74f6fd1a751c53f7415628c4194bcb613e7b60bc250401e76bd2ad779999cc3d6ce70b39cbc496af302ae178

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe

Filesize
263KB

MD5
e0157c7e823d513fb8f8fa3b2a862770

SHA1
b9ecdb2c518b226e1b4782cf2198f85d8f4a5b0b

SHA256
6151f57b5c083b5ad37c4849040c48717ad157dddd2f6c31271a93e04c715b29

SHA512
3b29bb1d73f26b3023f3cba453aad81f76218b5567e96439da0cdacce1193859ee048c07c2a4354194a07af0768b84fb12e0a8cdb7cb2d555f1ee28ffe7e165c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe

Filesize
263KB

MD5
e0157c7e823d513fb8f8fa3b2a862770

SHA1
b9ecdb2c518b226e1b4782cf2198f85d8f4a5b0b

SHA256
6151f57b5c083b5ad37c4849040c48717ad157dddd2f6c31271a93e04c715b29

SHA512
3b29bb1d73f26b3023f3cba453aad81f76218b5567e96439da0cdacce1193859ee048c07c2a4354194a07af0768b84fb12e0a8cdb7cb2d555f1ee28ffe7e165c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe

Filesize
263KB

MD5
e0157c7e823d513fb8f8fa3b2a862770

SHA1
b9ecdb2c518b226e1b4782cf2198f85d8f4a5b0b

SHA256
6151f57b5c083b5ad37c4849040c48717ad157dddd2f6c31271a93e04c715b29

SHA512
3b29bb1d73f26b3023f3cba453aad81f76218b5567e96439da0cdacce1193859ee048c07c2a4354194a07af0768b84fb12e0a8cdb7cb2d555f1ee28ffe7e165c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe

Filesize
328KB

MD5
d3c887ffdd796175ae11f5c6eca49393

SHA1
6770ebf510b60b5ec1b43ce9e06b9a36cc0d20fa

SHA256
d5248c945dd288f4df2e869df94201ab9ead97d3c8ffe6c4c78547b257556bbd

SHA512
daeed55fa47002d6567d648259e0de42ad814a8a3ef068ec5a632165cffaebb77ee065c110c7ed118c5fa862b454099df9080391e0c37b298cbf26e3c19ba86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe

Filesize
328KB

MD5
d3c887ffdd796175ae11f5c6eca49393

SHA1
6770ebf510b60b5ec1b43ce9e06b9a36cc0d20fa

SHA256
d5248c945dd288f4df2e869df94201ab9ead97d3c8ffe6c4c78547b257556bbd

SHA512
daeed55fa47002d6567d648259e0de42ad814a8a3ef068ec5a632165cffaebb77ee065c110c7ed118c5fa862b454099df9080391e0c37b298cbf26e3c19ba86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe

Filesize
328KB

MD5
d3c887ffdd796175ae11f5c6eca49393

SHA1
6770ebf510b60b5ec1b43ce9e06b9a36cc0d20fa

SHA256
d5248c945dd288f4df2e869df94201ab9ead97d3c8ffe6c4c78547b257556bbd

SHA512
daeed55fa47002d6567d648259e0de42ad814a8a3ef068ec5a632165cffaebb77ee065c110c7ed118c5fa862b454099df9080391e0c37b298cbf26e3c19ba86a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un855735.exe

Filesize
543KB

MD5
392265fa634ad111c20ce760b126c045

SHA1
e83f0ea66f6f56b2fafb9d1bd6ba5c2de7843b9b

SHA256
cdf0980b713c33a34fdbabe794727ffae99d8b9f35426342565f51c491bd2cbf

SHA512
bc5b1ec2403768a0de3d321d9cc82abd3c80da7e74f6fd1a751c53f7415628c4194bcb613e7b60bc250401e76bd2ad779999cc3d6ce70b39cbc496af302ae178

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\un855735.exe

Filesize
543KB

MD5
392265fa634ad111c20ce760b126c045

SHA1
e83f0ea66f6f56b2fafb9d1bd6ba5c2de7843b9b

SHA256
cdf0980b713c33a34fdbabe794727ffae99d8b9f35426342565f51c491bd2cbf

SHA512
bc5b1ec2403768a0de3d321d9cc82abd3c80da7e74f6fd1a751c53f7415628c4194bcb613e7b60bc250401e76bd2ad779999cc3d6ce70b39cbc496af302ae178

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe

Filesize
263KB

MD5
e0157c7e823d513fb8f8fa3b2a862770

SHA1
b9ecdb2c518b226e1b4782cf2198f85d8f4a5b0b

SHA256
6151f57b5c083b5ad37c4849040c48717ad157dddd2f6c31271a93e04c715b29

SHA512
3b29bb1d73f26b3023f3cba453aad81f76218b5567e96439da0cdacce1193859ee048c07c2a4354194a07af0768b84fb12e0a8cdb7cb2d555f1ee28ffe7e165c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe

Filesize
263KB

MD5
e0157c7e823d513fb8f8fa3b2a862770

SHA1
b9ecdb2c518b226e1b4782cf2198f85d8f4a5b0b

SHA256
6151f57b5c083b5ad37c4849040c48717ad157dddd2f6c31271a93e04c715b29

SHA512
3b29bb1d73f26b3023f3cba453aad81f76218b5567e96439da0cdacce1193859ee048c07c2a4354194a07af0768b84fb12e0a8cdb7cb2d555f1ee28ffe7e165c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\79626243.exe

Filesize
263KB

MD5
e0157c7e823d513fb8f8fa3b2a862770

SHA1
b9ecdb2c518b226e1b4782cf2198f85d8f4a5b0b

SHA256
6151f57b5c083b5ad37c4849040c48717ad157dddd2f6c31271a93e04c715b29

SHA512
3b29bb1d73f26b3023f3cba453aad81f76218b5567e96439da0cdacce1193859ee048c07c2a4354194a07af0768b84fb12e0a8cdb7cb2d555f1ee28ffe7e165c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe

Filesize
328KB

MD5
d3c887ffdd796175ae11f5c6eca49393

SHA1
6770ebf510b60b5ec1b43ce9e06b9a36cc0d20fa

SHA256
d5248c945dd288f4df2e869df94201ab9ead97d3c8ffe6c4c78547b257556bbd

SHA512
daeed55fa47002d6567d648259e0de42ad814a8a3ef068ec5a632165cffaebb77ee065c110c7ed118c5fa862b454099df9080391e0c37b298cbf26e3c19ba86a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe

Filesize
328KB

MD5
d3c887ffdd796175ae11f5c6eca49393

SHA1
6770ebf510b60b5ec1b43ce9e06b9a36cc0d20fa

SHA256
d5248c945dd288f4df2e869df94201ab9ead97d3c8ffe6c4c78547b257556bbd

SHA512
daeed55fa47002d6567d648259e0de42ad814a8a3ef068ec5a632165cffaebb77ee065c110c7ed118c5fa862b454099df9080391e0c37b298cbf26e3c19ba86a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk346782.exe

Filesize
328KB

MD5
d3c887ffdd796175ae11f5c6eca49393

SHA1
6770ebf510b60b5ec1b43ce9e06b9a36cc0d20fa

SHA256
d5248c945dd288f4df2e869df94201ab9ead97d3c8ffe6c4c78547b257556bbd

SHA512
daeed55fa47002d6567d648259e0de42ad814a8a3ef068ec5a632165cffaebb77ee065c110c7ed118c5fa862b454099df9080391e0c37b298cbf26e3c19ba86a

Download Submit
memory/468-108-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-84-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-86-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-88-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-90-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-92-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-94-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-96-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-98-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-102-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-100-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-104-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-106-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-110-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-83-0x0000000002CB0000-0x0000000002CC3000-memory.dmp

Filesize
76KB

Download
memory/468-111-0x0000000000400000-0x0000000002B99000-memory.dmp

Filesize
39.6MB

Download
memory/468-112-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/468-82-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/468-81-0x00000000071C0000-0x0000000007200000-memory.dmp

Filesize
256KB

Download
memory/468-80-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/468-79-0x0000000002CB0000-0x0000000002CC8000-memory.dmp

Filesize
96KB

Download
memory/468-78-0x00000000003D0000-0x00000000003EA000-memory.dmp

Filesize
104KB

Download
memory/468-114-0x0000000000400000-0x0000000002B99000-memory.dmp

Filesize
39.6MB

Download
memory/744-125-0x0000000003160000-0x000000000319C000-memory.dmp

Filesize
240KB

Download
memory/744-126-0x0000000003200000-0x000000000323A000-memory.dmp

Filesize
232KB

Download
memory/744-127-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-128-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-130-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-132-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-134-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-137-0x0000000000290000-0x00000000002D6000-memory.dmp

Filesize
280KB

Download
memory/744-136-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-140-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-139-0x00000000072C0000-0x0000000007300000-memory.dmp

Filesize
256KB

Download
memory/744-141-0x00000000072C0000-0x0000000007300000-memory.dmp

Filesize
256KB

Download
memory/744-143-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-145-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-147-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-149-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-151-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-153-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-155-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-157-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-159-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-161-0x0000000003200000-0x0000000003235000-memory.dmp

Filesize
212KB

Download
memory/744-922-0x00000000072C0000-0x0000000007300000-memory.dmp

Filesize
256KB

Download
memory/744-925-0x00000000072C0000-0x0000000007300000-memory.dmp

Filesize
256KB

Download