52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4

Analysis

max time kernel
171s
max time network
207s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
Size

480KB
MD5

20d04c1821001d935d8ab428d07f5b3f
SHA1

a0f3de5c6fd5a77f69b2968f06658b53ed4c8496
SHA256

52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4
SHA512

3f4fe8241d327aa6d000641aef14848564e9a23ea8e178fc77832a334d484f709241b2fb701cb3d0ebd7e287b62c209b181260eaf71767f92b989732434e169a
SSDEEP

12288:7Mrmy90FSy38Te3E2PBa2lcg7jBe3/HI:RycpDfb2/HI

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k5630612.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k5630612.exe

Executes dropped EXE 3 IoCs

pid	Process
1660	y4958066.exe
1636	k5630612.exe
1276	l1751665.exe

Loads dropped DLL 6 IoCs

pid	Process
1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
1660	y4958066.exe
1660	y4958066.exe
1636	k5630612.exe
1660	y4958066.exe
1276	l1751665.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	k5630612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k5630612.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4958066.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	y4958066.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	k5630612.exe
1636	k5630612.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	k5630612.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1708 wrote to memory of 1660	1708	52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe	28
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1636	1660	y4958066.exe	29
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30
PID 1660 wrote to memory of 1276	1660	y4958066.exe	30

C:\Users\Admin\AppData\Local\Temp\52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe
"C:\Users\Admin\AppData\Local\Temp\52387ccf1edb1a80d1c15873e3f3ac88c79a4fd8d5429956417124526e1a0cc4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe

Filesize
308KB

MD5
eb2321f22fccc87d94be2a78f9fb55d4

SHA1
7312e0b8d91b6fef143210018e197f37d88cdb02

SHA256
c04ece41160b6a5d5ae7720dd860b06ed8b10bff489d0622397cddb0f148fec0

SHA512
d8e46ec7eb047ae3a2c488e66a124e7a5641509c12c1c939b7dfa1fffb77eb3f4903d79cf5f6aadb1d046d683a17a3313bfd853917a8011a7f82a4efd11141d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe

Filesize
308KB

MD5
eb2321f22fccc87d94be2a78f9fb55d4

SHA1
7312e0b8d91b6fef143210018e197f37d88cdb02

SHA256
c04ece41160b6a5d5ae7720dd860b06ed8b10bff489d0622397cddb0f148fec0

SHA512
d8e46ec7eb047ae3a2c488e66a124e7a5641509c12c1c939b7dfa1fffb77eb3f4903d79cf5f6aadb1d046d683a17a3313bfd853917a8011a7f82a4efd11141d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe

Filesize
175KB

MD5
21f8954889b59e6afc4dbf41c37bf0b8

SHA1
e7d042d8bd2004849223c8a879aa0c8314d270bd

SHA256
e543c867903a75f0332d482dc6f1e93c420e60af702f2874eda18d129486ace9

SHA512
9c6020cbf8a39eaf89190681304cc78131394096ed6de5343e640d72bfd4106094096bea5cb9720781bbc7f40ecc4cc3bb1a4f540623268e03960ed2623755fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe

Filesize
175KB

MD5
21f8954889b59e6afc4dbf41c37bf0b8

SHA1
e7d042d8bd2004849223c8a879aa0c8314d270bd

SHA256
e543c867903a75f0332d482dc6f1e93c420e60af702f2874eda18d129486ace9

SHA512
9c6020cbf8a39eaf89190681304cc78131394096ed6de5343e640d72bfd4106094096bea5cb9720781bbc7f40ecc4cc3bb1a4f540623268e03960ed2623755fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe

Filesize
136KB

MD5
8634c9d171196625c56c8491c34654ea

SHA1
a53a484bad479aa59671be81c7109c5b58c43919

SHA256
48703068e8f7ac6cf57fdbdf7c2d2272be457ffcfb168bce785ed5ea6ea087f4

SHA512
5436b2c4cc147f7bae0e25dda9456d261bbe5293493b58e0c266106dbb7aa4c12a9aa95207bf32c4acac3a66144200f138ae02e68a66de7e3a297f9e29f254bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe

Filesize
136KB

MD5
8634c9d171196625c56c8491c34654ea

SHA1
a53a484bad479aa59671be81c7109c5b58c43919

SHA256
48703068e8f7ac6cf57fdbdf7c2d2272be457ffcfb168bce785ed5ea6ea087f4

SHA512
5436b2c4cc147f7bae0e25dda9456d261bbe5293493b58e0c266106dbb7aa4c12a9aa95207bf32c4acac3a66144200f138ae02e68a66de7e3a297f9e29f254bd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe

Filesize
308KB

MD5
eb2321f22fccc87d94be2a78f9fb55d4

SHA1
7312e0b8d91b6fef143210018e197f37d88cdb02

SHA256
c04ece41160b6a5d5ae7720dd860b06ed8b10bff489d0622397cddb0f148fec0

SHA512
d8e46ec7eb047ae3a2c488e66a124e7a5641509c12c1c939b7dfa1fffb77eb3f4903d79cf5f6aadb1d046d683a17a3313bfd853917a8011a7f82a4efd11141d6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4958066.exe

Filesize
308KB

MD5
eb2321f22fccc87d94be2a78f9fb55d4

SHA1
7312e0b8d91b6fef143210018e197f37d88cdb02

SHA256
c04ece41160b6a5d5ae7720dd860b06ed8b10bff489d0622397cddb0f148fec0

SHA512
d8e46ec7eb047ae3a2c488e66a124e7a5641509c12c1c939b7dfa1fffb77eb3f4903d79cf5f6aadb1d046d683a17a3313bfd853917a8011a7f82a4efd11141d6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe

Filesize
175KB

MD5
21f8954889b59e6afc4dbf41c37bf0b8

SHA1
e7d042d8bd2004849223c8a879aa0c8314d270bd

SHA256
e543c867903a75f0332d482dc6f1e93c420e60af702f2874eda18d129486ace9

SHA512
9c6020cbf8a39eaf89190681304cc78131394096ed6de5343e640d72bfd4106094096bea5cb9720781bbc7f40ecc4cc3bb1a4f540623268e03960ed2623755fa

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\k5630612.exe

Filesize
175KB

MD5
21f8954889b59e6afc4dbf41c37bf0b8

SHA1
e7d042d8bd2004849223c8a879aa0c8314d270bd

SHA256
e543c867903a75f0332d482dc6f1e93c420e60af702f2874eda18d129486ace9

SHA512
9c6020cbf8a39eaf89190681304cc78131394096ed6de5343e640d72bfd4106094096bea5cb9720781bbc7f40ecc4cc3bb1a4f540623268e03960ed2623755fa

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe

Filesize
136KB

MD5
8634c9d171196625c56c8491c34654ea

SHA1
a53a484bad479aa59671be81c7109c5b58c43919

SHA256
48703068e8f7ac6cf57fdbdf7c2d2272be457ffcfb168bce785ed5ea6ea087f4

SHA512
5436b2c4cc147f7bae0e25dda9456d261bbe5293493b58e0c266106dbb7aa4c12a9aa95207bf32c4acac3a66144200f138ae02e68a66de7e3a297f9e29f254bd

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1751665.exe

Filesize
136KB

MD5
8634c9d171196625c56c8491c34654ea

SHA1
a53a484bad479aa59671be81c7109c5b58c43919

SHA256
48703068e8f7ac6cf57fdbdf7c2d2272be457ffcfb168bce785ed5ea6ea087f4

SHA512
5436b2c4cc147f7bae0e25dda9456d261bbe5293493b58e0c266106dbb7aa4c12a9aa95207bf32c4acac3a66144200f138ae02e68a66de7e3a297f9e29f254bd

Download Submit
memory/1276-113-0x0000000000210000-0x0000000000238000-memory.dmp

Filesize
160KB

Download
memory/1276-114-0x0000000006FC0000-0x0000000007000000-memory.dmp

Filesize
256KB

Download
memory/1276-115-0x0000000006FC0000-0x0000000007000000-memory.dmp

Filesize
256KB

Download
memory/1636-85-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-105-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-87-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-89-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-91-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-93-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-95-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-97-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-99-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-83-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-103-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-101-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-106-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1636-81-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-79-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-78-0x0000000001F10000-0x0000000001F22000-memory.dmp

Filesize
72KB

Download
memory/1636-77-0x0000000001F10000-0x0000000001F28000-memory.dmp

Filesize
96KB

Download
memory/1636-75-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1636-76-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1636-74-0x0000000000980000-0x000000000099A000-memory.dmp

Filesize
104KB

Download