Analysis

  • max time kernel
    147s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06-05-2023 22:17

General

  • Target

    6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7.exe

  • Size

    563KB

  • MD5

    a4cf2f9da373bd7e6848450658a63a4c

  • SHA1

    960e9e70797029454aea92d7f34e248447fa9bb9

  • SHA256

    6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7

  • SHA512

    2e79b62e836f6c93ddb116fa737f19e1943ccddb62e42f6ff92b7030b586f45842176c19edebe907e3fe660cb608ffb42c53813486247251a655a5e73f0b23e5

  • SSDEEP

    12288:Ry908wJpw11whEFUmslIhzzq0tnzwMGDO0tPodb1rJ++:RyCJ+6mF5N/ltn0FDVdY1rJn

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7.exe
    "C:\Users\Admin\AppData\Local\Temp\6653e65b8fae1209ac68b409304e909872790d8d6f065642695e902c3f10c8a7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st026906.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st026906.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18169586.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18169586.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st026906.exe

    Filesize

    409KB

    MD5

    4594780878c0c251eda7f792096b4004

    SHA1

    e9ab5613180a18c6198d92d5cdb72468dde29c7c

    SHA256

    1466f8e2b9ad93b7f153814408eac49b74387443f45bf47a62fb7649448f343a

    SHA512

    b635af903b58f821c21bff80b66260623d5d37cd7cb8827782b97d98c71610d2cbf726ff80fa4b5ca15866f4bccc08fae07f07c70491f4e1799706eeff6048f4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st026906.exe

    Filesize

    409KB

    MD5

    4594780878c0c251eda7f792096b4004

    SHA1

    e9ab5613180a18c6198d92d5cdb72468dde29c7c

    SHA256

    1466f8e2b9ad93b7f153814408eac49b74387443f45bf47a62fb7649448f343a

    SHA512

    b635af903b58f821c21bff80b66260623d5d37cd7cb8827782b97d98c71610d2cbf726ff80fa4b5ca15866f4bccc08fae07f07c70491f4e1799706eeff6048f4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18169586.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\18169586.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe

    Filesize

    361KB

    MD5

    6620432e8a6dd4af816f2f72b7706fae

    SHA1

    0caf9d0907ecddd6bd5f70afe4aac77165f46c01

    SHA256

    1115e14fcc3a1cd947036d42d6845364aa673f22a9095bb50befdcab6799afb0

    SHA512

    c2c969a50a30eca6e8c7ddb3897e972a59ee7e83e38191c2dae7ccaf43e8f08b27fc7e1415e73f2ecfb27f482fb992793fe2e4b266892e6bec00860d08e6086e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe

    Filesize

    361KB

    MD5

    6620432e8a6dd4af816f2f72b7706fae

    SHA1

    0caf9d0907ecddd6bd5f70afe4aac77165f46c01

    SHA256

    1115e14fcc3a1cd947036d42d6845364aa673f22a9095bb50befdcab6799afb0

    SHA512

    c2c969a50a30eca6e8c7ddb3897e972a59ee7e83e38191c2dae7ccaf43e8f08b27fc7e1415e73f2ecfb27f482fb992793fe2e4b266892e6bec00860d08e6086e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe

    Filesize

    361KB

    MD5

    6620432e8a6dd4af816f2f72b7706fae

    SHA1

    0caf9d0907ecddd6bd5f70afe4aac77165f46c01

    SHA256

    1115e14fcc3a1cd947036d42d6845364aa673f22a9095bb50befdcab6799afb0

    SHA512

    c2c969a50a30eca6e8c7ddb3897e972a59ee7e83e38191c2dae7ccaf43e8f08b27fc7e1415e73f2ecfb27f482fb992793fe2e4b266892e6bec00860d08e6086e

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st026906.exe

    Filesize

    409KB

    MD5

    4594780878c0c251eda7f792096b4004

    SHA1

    e9ab5613180a18c6198d92d5cdb72468dde29c7c

    SHA256

    1466f8e2b9ad93b7f153814408eac49b74387443f45bf47a62fb7649448f343a

    SHA512

    b635af903b58f821c21bff80b66260623d5d37cd7cb8827782b97d98c71610d2cbf726ff80fa4b5ca15866f4bccc08fae07f07c70491f4e1799706eeff6048f4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st026906.exe

    Filesize

    409KB

    MD5

    4594780878c0c251eda7f792096b4004

    SHA1

    e9ab5613180a18c6198d92d5cdb72468dde29c7c

    SHA256

    1466f8e2b9ad93b7f153814408eac49b74387443f45bf47a62fb7649448f343a

    SHA512

    b635af903b58f821c21bff80b66260623d5d37cd7cb8827782b97d98c71610d2cbf726ff80fa4b5ca15866f4bccc08fae07f07c70491f4e1799706eeff6048f4

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\18169586.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe

    Filesize

    361KB

    MD5

    6620432e8a6dd4af816f2f72b7706fae

    SHA1

    0caf9d0907ecddd6bd5f70afe4aac77165f46c01

    SHA256

    1115e14fcc3a1cd947036d42d6845364aa673f22a9095bb50befdcab6799afb0

    SHA512

    c2c969a50a30eca6e8c7ddb3897e972a59ee7e83e38191c2dae7ccaf43e8f08b27fc7e1415e73f2ecfb27f482fb992793fe2e4b266892e6bec00860d08e6086e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe

    Filesize

    361KB

    MD5

    6620432e8a6dd4af816f2f72b7706fae

    SHA1

    0caf9d0907ecddd6bd5f70afe4aac77165f46c01

    SHA256

    1115e14fcc3a1cd947036d42d6845364aa673f22a9095bb50befdcab6799afb0

    SHA512

    c2c969a50a30eca6e8c7ddb3897e972a59ee7e83e38191c2dae7ccaf43e8f08b27fc7e1415e73f2ecfb27f482fb992793fe2e4b266892e6bec00860d08e6086e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp499066.exe

    Filesize

    361KB

    MD5

    6620432e8a6dd4af816f2f72b7706fae

    SHA1

    0caf9d0907ecddd6bd5f70afe4aac77165f46c01

    SHA256

    1115e14fcc3a1cd947036d42d6845364aa673f22a9095bb50befdcab6799afb0

    SHA512

    c2c969a50a30eca6e8c7ddb3897e972a59ee7e83e38191c2dae7ccaf43e8f08b27fc7e1415e73f2ecfb27f482fb992793fe2e4b266892e6bec00860d08e6086e

  • memory/688-72-0x0000000001310000-0x000000000131A000-memory.dmp

    Filesize

    40KB

  • memory/1636-104-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-122-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-85-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-86-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-88-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-90-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-92-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-94-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-96-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-98-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-100-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-106-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-83-0x0000000004940000-0x000000000497C000-memory.dmp

    Filesize

    240KB

  • memory/1636-102-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-108-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-110-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-112-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-114-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-116-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-118-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-120-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-84-0x00000000049D0000-0x0000000004A0A000-memory.dmp

    Filesize

    232KB

  • memory/1636-124-0x00000000003A0000-0x00000000003E6000-memory.dmp

    Filesize

    280KB

  • memory/1636-126-0x0000000004A30000-0x0000000004A70000-memory.dmp

    Filesize

    256KB

  • memory/1636-127-0x0000000004A30000-0x0000000004A70000-memory.dmp

    Filesize

    256KB

  • memory/1636-125-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-129-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-131-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-133-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-135-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-137-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-139-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-141-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-143-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-145-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-147-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-149-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-151-0x00000000049D0000-0x0000000004A05000-memory.dmp

    Filesize

    212KB

  • memory/1636-880-0x0000000004A30000-0x0000000004A70000-memory.dmp

    Filesize

    256KB

  • memory/1636-882-0x0000000004A30000-0x0000000004A70000-memory.dmp

    Filesize

    256KB

  • memory/1636-884-0x0000000004A30000-0x0000000004A70000-memory.dmp

    Filesize

    256KB