662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe
Size

618KB
MD5

51f46d7c3e0643880d6a7ad7f511e5af
SHA1

301e342102fae2537d136b0cb93fe6b332f3ab86
SHA256

662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373
SHA512

00d47cb9308436b9ad017a3894f6c9e41d32d5a44f03a78d7f9a19d31edc30a4688e2275cd1281c31bb201f168e17afc2592a8cf3b46ae8fee52bbe6034f28fe
SSDEEP

12288:1y90ILG7DRQs7RZYagSucZLjTHW5z1WPJ2v+1ZG:1yVoDV2ago165z1WPyQG

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	97711157.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	97711157.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	97711157.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	97711157.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	97711157.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	97711157.exe

Executes dropped EXE 3 IoCs

pid	Process
956	st316088.exe
540	97711157.exe
1492	kp809501.exe

Loads dropped DLL 6 IoCs

pid	Process
1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe
956	st316088.exe
956	st316088.exe
956	st316088.exe
956	st316088.exe
1492	kp809501.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	97711157.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	97711157.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st316088.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st316088.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
540	97711157.exe
540	97711157.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	97711157.exe
Token: SeDebugPrivilege	1492	kp809501.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 1460 wrote to memory of 956	1460	662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe	28
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 540	956	st316088.exe	27
PID 956 wrote to memory of 1492	956	st316088.exe	29
PID 956 wrote to memory of 1492	956	st316088.exe	29
PID 956 wrote to memory of 1492	956	st316088.exe	29
PID 956 wrote to memory of 1492	956	st316088.exe	29
PID 956 wrote to memory of 1492	956	st316088.exe	29
PID 956 wrote to memory of 1492	956	st316088.exe	29
PID 956 wrote to memory of 1492	956	st316088.exe	29

C:\Users\Admin\AppData\Local\Temp\662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe
"C:\Users\Admin\AppData\Local\Temp\662561ce59f1d19d50c5f5e1f8e6c3ea9678269bae8f8d9d310bcc9053301373.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st316088.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st316088.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1492

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97711157.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97711157.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st316088.exe

Filesize
464KB

MD5
74b85911d011d404e1714414ca26c046

SHA1
c991b22db2d7cb15b98de559db26469303ae5211

SHA256
8fb000d4b5ea1e768814203fbe14c6015285dae7e2f31bc6607c973456ef84eb

SHA512
06188b1df6c9e208dbcf2c87babafccfec8563de39ff38315d4b1b9adaba068cbf88c7f4c67af476e418f0a25decc618af05a0910e5f1f0381648f3b070e5036

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st316088.exe

Filesize
464KB

MD5
74b85911d011d404e1714414ca26c046

SHA1
c991b22db2d7cb15b98de559db26469303ae5211

SHA256
8fb000d4b5ea1e768814203fbe14c6015285dae7e2f31bc6607c973456ef84eb

SHA512
06188b1df6c9e208dbcf2c87babafccfec8563de39ff38315d4b1b9adaba068cbf88c7f4c67af476e418f0a25decc618af05a0910e5f1f0381648f3b070e5036

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97711157.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97711157.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe

Filesize
478KB

MD5
bfc0d391966cd5259c28a2ad2a0f0f3e

SHA1
edf2be770c81666bfd2410810bb57949f2729219

SHA256
85c63edc2a48594c62d06fd6e80ddc650b3dcde6151241d261514274ce30691c

SHA512
19add3338ca8afc304e0c70f4a3490d7ec48fd55da41ec9938c5721efad53fa1f7028eede43c1ed05f2378e317198a9a8851cb670bdc7a24b99e0dbf3b211ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe

Filesize
478KB

MD5
bfc0d391966cd5259c28a2ad2a0f0f3e

SHA1
edf2be770c81666bfd2410810bb57949f2729219

SHA256
85c63edc2a48594c62d06fd6e80ddc650b3dcde6151241d261514274ce30691c

SHA512
19add3338ca8afc304e0c70f4a3490d7ec48fd55da41ec9938c5721efad53fa1f7028eede43c1ed05f2378e317198a9a8851cb670bdc7a24b99e0dbf3b211ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe

Filesize
478KB

MD5
bfc0d391966cd5259c28a2ad2a0f0f3e

SHA1
edf2be770c81666bfd2410810bb57949f2729219

SHA256
85c63edc2a48594c62d06fd6e80ddc650b3dcde6151241d261514274ce30691c

SHA512
19add3338ca8afc304e0c70f4a3490d7ec48fd55da41ec9938c5721efad53fa1f7028eede43c1ed05f2378e317198a9a8851cb670bdc7a24b99e0dbf3b211ed8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\st316088.exe

Filesize
464KB

MD5
74b85911d011d404e1714414ca26c046

SHA1
c991b22db2d7cb15b98de559db26469303ae5211

SHA256
8fb000d4b5ea1e768814203fbe14c6015285dae7e2f31bc6607c973456ef84eb

SHA512
06188b1df6c9e208dbcf2c87babafccfec8563de39ff38315d4b1b9adaba068cbf88c7f4c67af476e418f0a25decc618af05a0910e5f1f0381648f3b070e5036

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\st316088.exe

Filesize
464KB

MD5
74b85911d011d404e1714414ca26c046

SHA1
c991b22db2d7cb15b98de559db26469303ae5211

SHA256
8fb000d4b5ea1e768814203fbe14c6015285dae7e2f31bc6607c973456ef84eb

SHA512
06188b1df6c9e208dbcf2c87babafccfec8563de39ff38315d4b1b9adaba068cbf88c7f4c67af476e418f0a25decc618af05a0910e5f1f0381648f3b070e5036

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\97711157.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe

Filesize
478KB

MD5
bfc0d391966cd5259c28a2ad2a0f0f3e

SHA1
edf2be770c81666bfd2410810bb57949f2729219

SHA256
85c63edc2a48594c62d06fd6e80ddc650b3dcde6151241d261514274ce30691c

SHA512
19add3338ca8afc304e0c70f4a3490d7ec48fd55da41ec9938c5721efad53fa1f7028eede43c1ed05f2378e317198a9a8851cb670bdc7a24b99e0dbf3b211ed8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe

Filesize
478KB

MD5
bfc0d391966cd5259c28a2ad2a0f0f3e

SHA1
edf2be770c81666bfd2410810bb57949f2729219

SHA256
85c63edc2a48594c62d06fd6e80ddc650b3dcde6151241d261514274ce30691c

SHA512
19add3338ca8afc304e0c70f4a3490d7ec48fd55da41ec9938c5721efad53fa1f7028eede43c1ed05f2378e317198a9a8851cb670bdc7a24b99e0dbf3b211ed8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp809501.exe

Filesize
478KB

MD5
bfc0d391966cd5259c28a2ad2a0f0f3e

SHA1
edf2be770c81666bfd2410810bb57949f2729219

SHA256
85c63edc2a48594c62d06fd6e80ddc650b3dcde6151241d261514274ce30691c

SHA512
19add3338ca8afc304e0c70f4a3490d7ec48fd55da41ec9938c5721efad53fa1f7028eede43c1ed05f2378e317198a9a8851cb670bdc7a24b99e0dbf3b211ed8

Download Submit
memory/540-72-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/1492-102-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-116-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-85-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/1492-86-0x00000000025C0000-0x00000000025FA000-memory.dmp

Filesize
232KB

Download
memory/1492-87-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-88-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-90-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-92-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-94-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-96-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-98-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-104-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-83-0x00000000024D0000-0x000000000250C000-memory.dmp

Filesize
240KB

Download
memory/1492-100-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-106-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-108-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-110-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-112-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-114-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-84-0x0000000000290000-0x00000000002D6000-memory.dmp

Filesize
280KB

Download
memory/1492-118-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-120-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-122-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-124-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-126-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-128-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-130-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-132-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-134-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-136-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-138-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-140-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-142-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-144-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-146-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-148-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-150-0x00000000025C0000-0x00000000025F5000-memory.dmp

Filesize
212KB

Download
memory/1492-879-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/1492-882-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download