Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
Resource
win10v2004-20230220-en
General
-
Target
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
-
Size
562KB
-
MD5
6d88965f4484398951970344837363f8
-
SHA1
fec55bcf9c071c6a38d6a8eabafb39fb5dc654d4
-
SHA256
576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59
-
SHA512
54263ba5c9da5f4456a5d2baf1f9f3781ab84c681e04942233c90cfd4f398061592cb0f40e7e1fdc12fa94389a62745c48032a30a26569c852a367f4f1941896
-
SSDEEP
12288:Hy90SyDk5J4dZz/AmaLEOkoVsoFzI/7KJDhSgi:HyVygfw/YQVE/FM2Z7i
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 84334617.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 84334617.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 84334617.exe -
Executes dropped EXE 3 IoCs
pid Process 908 st673337.exe 1044 84334617.exe 268 kp678488.exe -
Loads dropped DLL 6 IoCs
pid Process 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 908 st673337.exe 908 st673337.exe 908 st673337.exe 908 st673337.exe 268 kp678488.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 84334617.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 84334617.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce st673337.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st673337.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1044 84334617.exe 1044 84334617.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1044 84334617.exe Token: SeDebugPrivilege 268 kp678488.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 1528 wrote to memory of 908 1528 576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe 28 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 1044 908 st673337.exe 29 PID 908 wrote to memory of 268 908 st673337.exe 30 PID 908 wrote to memory of 268 908 st673337.exe 30 PID 908 wrote to memory of 268 908 st673337.exe 30 PID 908 wrote to memory of 268 908 st673337.exe 30 PID 908 wrote to memory of 268 908 st673337.exe 30 PID 908 wrote to memory of 268 908 st673337.exe 30 PID 908 wrote to memory of 268 908 st673337.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe"C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5b0f544026ac1efb4e78fdf207e92f70b
SHA1374b036579ea74abf7d436ff017ef432fdeb3587
SHA256852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe
SHA512761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2
-
Filesize
408KB
MD5b0f544026ac1efb4e78fdf207e92f70b
SHA1374b036579ea74abf7d436ff017ef432fdeb3587
SHA256852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe
SHA512761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a
-
Filesize
408KB
MD5b0f544026ac1efb4e78fdf207e92f70b
SHA1374b036579ea74abf7d436ff017ef432fdeb3587
SHA256852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe
SHA512761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2
-
Filesize
408KB
MD5b0f544026ac1efb4e78fdf207e92f70b
SHA1374b036579ea74abf7d436ff017ef432fdeb3587
SHA256852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe
SHA512761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a
-
Filesize
360KB
MD52a5caeeded3331a633e4e2a282ebb4a0
SHA1ec5d990bf6c4afe4908f87588311631b0629f72f
SHA2562441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3
SHA512006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a