Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 21:59

General

  • Target

    555c2548f2747ea170f1739f78993faa2cb9679ab5f7506994702065c2d42750.exe

  • Size

    617KB

  • MD5

    0d137f931dec213f9689aa7653ccc356

  • SHA1

    8e8d3ed73718307e884a50219e68329792646f4a

  • SHA256

    555c2548f2747ea170f1739f78993faa2cb9679ab5f7506994702065c2d42750

  • SHA512

    65c3697fb8da53065a001bfab723ac0719c8ae71689942a566eae46e519323c72621fb13d8ee7e829073f891d8510fd2e045648cccc38bc4ed530004a8826168

  • SSDEEP

    12288:my90j6toTLidRMCV6HjjKRxdcKiWMi+W4TcJ2S4L8:myrOLiXeDj2SKOi+fa2BL8

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\555c2548f2747ea170f1739f78993faa2cb9679ab5f7506994702065c2d42750.exe
    "C:\Users\Admin\AppData\Local\Temp\555c2548f2747ea170f1739f78993faa2cb9679ab5f7506994702065c2d42750.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st190935.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st190935.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\62567553.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\62567553.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1944
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:584

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st190935.exe

    Filesize

    463KB

    MD5

    4d3e3ba8b6e48b367bdeb3ad0f6e87e5

    SHA1

    e45ebc6a7f7568752df2ecf0972bfc7799e4b112

    SHA256

    e21f6a133e9984ee1dbf55b2552b46e91a82723edebd18b24765af1b190b376d

    SHA512

    2beab9190cde8290d9a08287384833a266f43941dc005abf2246fe0da69c2124e0b9600a243a35b0af29434f582213fddd94abecd6b154ac524bfac893f8aa01

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st190935.exe

    Filesize

    463KB

    MD5

    4d3e3ba8b6e48b367bdeb3ad0f6e87e5

    SHA1

    e45ebc6a7f7568752df2ecf0972bfc7799e4b112

    SHA256

    e21f6a133e9984ee1dbf55b2552b46e91a82723edebd18b24765af1b190b376d

    SHA512

    2beab9190cde8290d9a08287384833a266f43941dc005abf2246fe0da69c2124e0b9600a243a35b0af29434f582213fddd94abecd6b154ac524bfac893f8aa01

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\62567553.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\62567553.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe

    Filesize

    473KB

    MD5

    c2fd71ee6d8fc08ba2f715577b3ab478

    SHA1

    857e8daffe6a043698621593412bccce2458ebc7

    SHA256

    ada60fe7bad1ae171ad7ff9aad45a2f65b863defd30e2e2bc1e7fbd5030dd178

    SHA512

    c03c0320baa030b3750865c3e698a6c0f384bf94c77c634ff551be75df85cdac573f892f1a01f199e568fc9e0689264493869bbe02da762f24f6f2e36ab69a55

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe

    Filesize

    473KB

    MD5

    c2fd71ee6d8fc08ba2f715577b3ab478

    SHA1

    857e8daffe6a043698621593412bccce2458ebc7

    SHA256

    ada60fe7bad1ae171ad7ff9aad45a2f65b863defd30e2e2bc1e7fbd5030dd178

    SHA512

    c03c0320baa030b3750865c3e698a6c0f384bf94c77c634ff551be75df85cdac573f892f1a01f199e568fc9e0689264493869bbe02da762f24f6f2e36ab69a55

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe

    Filesize

    473KB

    MD5

    c2fd71ee6d8fc08ba2f715577b3ab478

    SHA1

    857e8daffe6a043698621593412bccce2458ebc7

    SHA256

    ada60fe7bad1ae171ad7ff9aad45a2f65b863defd30e2e2bc1e7fbd5030dd178

    SHA512

    c03c0320baa030b3750865c3e698a6c0f384bf94c77c634ff551be75df85cdac573f892f1a01f199e568fc9e0689264493869bbe02da762f24f6f2e36ab69a55

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st190935.exe

    Filesize

    463KB

    MD5

    4d3e3ba8b6e48b367bdeb3ad0f6e87e5

    SHA1

    e45ebc6a7f7568752df2ecf0972bfc7799e4b112

    SHA256

    e21f6a133e9984ee1dbf55b2552b46e91a82723edebd18b24765af1b190b376d

    SHA512

    2beab9190cde8290d9a08287384833a266f43941dc005abf2246fe0da69c2124e0b9600a243a35b0af29434f582213fddd94abecd6b154ac524bfac893f8aa01

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st190935.exe

    Filesize

    463KB

    MD5

    4d3e3ba8b6e48b367bdeb3ad0f6e87e5

    SHA1

    e45ebc6a7f7568752df2ecf0972bfc7799e4b112

    SHA256

    e21f6a133e9984ee1dbf55b2552b46e91a82723edebd18b24765af1b190b376d

    SHA512

    2beab9190cde8290d9a08287384833a266f43941dc005abf2246fe0da69c2124e0b9600a243a35b0af29434f582213fddd94abecd6b154ac524bfac893f8aa01

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\62567553.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe

    Filesize

    473KB

    MD5

    c2fd71ee6d8fc08ba2f715577b3ab478

    SHA1

    857e8daffe6a043698621593412bccce2458ebc7

    SHA256

    ada60fe7bad1ae171ad7ff9aad45a2f65b863defd30e2e2bc1e7fbd5030dd178

    SHA512

    c03c0320baa030b3750865c3e698a6c0f384bf94c77c634ff551be75df85cdac573f892f1a01f199e568fc9e0689264493869bbe02da762f24f6f2e36ab69a55

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe

    Filesize

    473KB

    MD5

    c2fd71ee6d8fc08ba2f715577b3ab478

    SHA1

    857e8daffe6a043698621593412bccce2458ebc7

    SHA256

    ada60fe7bad1ae171ad7ff9aad45a2f65b863defd30e2e2bc1e7fbd5030dd178

    SHA512

    c03c0320baa030b3750865c3e698a6c0f384bf94c77c634ff551be75df85cdac573f892f1a01f199e568fc9e0689264493869bbe02da762f24f6f2e36ab69a55

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450642.exe

    Filesize

    473KB

    MD5

    c2fd71ee6d8fc08ba2f715577b3ab478

    SHA1

    857e8daffe6a043698621593412bccce2458ebc7

    SHA256

    ada60fe7bad1ae171ad7ff9aad45a2f65b863defd30e2e2bc1e7fbd5030dd178

    SHA512

    c03c0320baa030b3750865c3e698a6c0f384bf94c77c634ff551be75df85cdac573f892f1a01f199e568fc9e0689264493869bbe02da762f24f6f2e36ab69a55

  • memory/584-114-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-122-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-85-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-86-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-88-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-90-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-92-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-94-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-96-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-98-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-100-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-102-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-104-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-106-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-112-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-83-0x0000000002600000-0x000000000263C000-memory.dmp

    Filesize

    240KB

  • memory/584-110-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-108-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-116-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-118-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-120-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-84-0x0000000002730000-0x000000000276A000-memory.dmp

    Filesize

    232KB

  • memory/584-123-0x0000000000290000-0x00000000002D6000-memory.dmp

    Filesize

    280KB

  • memory/584-126-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-127-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/584-125-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/584-130-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-129-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/584-132-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-134-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-136-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-138-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-140-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-142-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-144-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-146-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-148-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-150-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-152-0x0000000002730000-0x0000000002765000-memory.dmp

    Filesize

    212KB

  • memory/584-881-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/584-883-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/584-885-0x0000000004E10000-0x0000000004E50000-memory.dmp

    Filesize

    256KB

  • memory/1944-72-0x0000000000C40000-0x0000000000C4A000-memory.dmp

    Filesize

    40KB