Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 22:29

General

  • Target

    70b671c7eb5ee48628e96439d58e01a899278c569e6dc1c67e8d6da24e599df6.exe

  • Size

    643KB

  • MD5

    c757fbb6177e19ce4f7d043634d888dd

  • SHA1

    16b13ce330435fe2b80fbcd1f4813d29f08b8b6d

  • SHA256

    70b671c7eb5ee48628e96439d58e01a899278c569e6dc1c67e8d6da24e599df6

  • SHA512

    e64c2feb1e085777ab2b6c0eae350f4cdab21e97f41e8c2fb8ff9e8c4891f86bf1cb4162901fa1693c1dd2c69de903ae02e6beca4f12cd764c2610ac4adc0eb3

  • SSDEEP

    12288:py90chrHstjNIkHHv2LZTrX7jxPV8q3suYkqxE/S+Bc1gJUyb9JWG:pyVHstScHohrBVUurqq/41gxhMG

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70b671c7eb5ee48628e96439d58e01a899278c569e6dc1c67e8d6da24e599df6.exe
    "C:\Users\Admin\AppData\Local\Temp\70b671c7eb5ee48628e96439d58e01a899278c569e6dc1c67e8d6da24e599df6.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st180668.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st180668.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66841873.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66841873.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:436
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st180668.exe

    Filesize

    489KB

    MD5

    e61ec5f867465cb46d83306e6797783d

    SHA1

    1e0dc7b4d18a11529fdc334ff0d9e105f9f2ccae

    SHA256

    de8b19bb8800221b83faf86600ce65dc814efd96de5909caed7862a89288c8c9

    SHA512

    45c971931ea20998750bf0d3e76dbc71f657ec38b2473d209b6f258a9cf3938ea6ac25556363564d4151b13d4c260d537d924729cad27d7a7e139d86a0f06f8d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st180668.exe

    Filesize

    489KB

    MD5

    e61ec5f867465cb46d83306e6797783d

    SHA1

    1e0dc7b4d18a11529fdc334ff0d9e105f9f2ccae

    SHA256

    de8b19bb8800221b83faf86600ce65dc814efd96de5909caed7862a89288c8c9

    SHA512

    45c971931ea20998750bf0d3e76dbc71f657ec38b2473d209b6f258a9cf3938ea6ac25556363564d4151b13d4c260d537d924729cad27d7a7e139d86a0f06f8d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66841873.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66841873.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe

    Filesize

    332KB

    MD5

    7d960538a58918d64d1727e03dfd2fea

    SHA1

    cf8869976030ffa688159808301e8b8506b4df73

    SHA256

    df53fa299e0eabd450144aec19a0ff0af3b6f6000f7250574bedd21e228d7258

    SHA512

    826df6af6379cd450aa988be227e540ae941e5bff452209f4595bee3eae8f4c42ed62953c1ec5b5e8311461c1a6cbaf8605ef35e19067edb9f21dc2dfea358bd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe

    Filesize

    332KB

    MD5

    7d960538a58918d64d1727e03dfd2fea

    SHA1

    cf8869976030ffa688159808301e8b8506b4df73

    SHA256

    df53fa299e0eabd450144aec19a0ff0af3b6f6000f7250574bedd21e228d7258

    SHA512

    826df6af6379cd450aa988be227e540ae941e5bff452209f4595bee3eae8f4c42ed62953c1ec5b5e8311461c1a6cbaf8605ef35e19067edb9f21dc2dfea358bd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe

    Filesize

    332KB

    MD5

    7d960538a58918d64d1727e03dfd2fea

    SHA1

    cf8869976030ffa688159808301e8b8506b4df73

    SHA256

    df53fa299e0eabd450144aec19a0ff0af3b6f6000f7250574bedd21e228d7258

    SHA512

    826df6af6379cd450aa988be227e540ae941e5bff452209f4595bee3eae8f4c42ed62953c1ec5b5e8311461c1a6cbaf8605ef35e19067edb9f21dc2dfea358bd

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st180668.exe

    Filesize

    489KB

    MD5

    e61ec5f867465cb46d83306e6797783d

    SHA1

    1e0dc7b4d18a11529fdc334ff0d9e105f9f2ccae

    SHA256

    de8b19bb8800221b83faf86600ce65dc814efd96de5909caed7862a89288c8c9

    SHA512

    45c971931ea20998750bf0d3e76dbc71f657ec38b2473d209b6f258a9cf3938ea6ac25556363564d4151b13d4c260d537d924729cad27d7a7e139d86a0f06f8d

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st180668.exe

    Filesize

    489KB

    MD5

    e61ec5f867465cb46d83306e6797783d

    SHA1

    1e0dc7b4d18a11529fdc334ff0d9e105f9f2ccae

    SHA256

    de8b19bb8800221b83faf86600ce65dc814efd96de5909caed7862a89288c8c9

    SHA512

    45c971931ea20998750bf0d3e76dbc71f657ec38b2473d209b6f258a9cf3938ea6ac25556363564d4151b13d4c260d537d924729cad27d7a7e139d86a0f06f8d

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\66841873.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\66841873.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe

    Filesize

    332KB

    MD5

    7d960538a58918d64d1727e03dfd2fea

    SHA1

    cf8869976030ffa688159808301e8b8506b4df73

    SHA256

    df53fa299e0eabd450144aec19a0ff0af3b6f6000f7250574bedd21e228d7258

    SHA512

    826df6af6379cd450aa988be227e540ae941e5bff452209f4595bee3eae8f4c42ed62953c1ec5b5e8311461c1a6cbaf8605ef35e19067edb9f21dc2dfea358bd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe

    Filesize

    332KB

    MD5

    7d960538a58918d64d1727e03dfd2fea

    SHA1

    cf8869976030ffa688159808301e8b8506b4df73

    SHA256

    df53fa299e0eabd450144aec19a0ff0af3b6f6000f7250574bedd21e228d7258

    SHA512

    826df6af6379cd450aa988be227e540ae941e5bff452209f4595bee3eae8f4c42ed62953c1ec5b5e8311461c1a6cbaf8605ef35e19067edb9f21dc2dfea358bd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp267984.exe

    Filesize

    332KB

    MD5

    7d960538a58918d64d1727e03dfd2fea

    SHA1

    cf8869976030ffa688159808301e8b8506b4df73

    SHA256

    df53fa299e0eabd450144aec19a0ff0af3b6f6000f7250574bedd21e228d7258

    SHA512

    826df6af6379cd450aa988be227e540ae941e5bff452209f4595bee3eae8f4c42ed62953c1ec5b5e8311461c1a6cbaf8605ef35e19067edb9f21dc2dfea358bd

  • memory/436-79-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-83-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-85-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-87-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-89-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-105-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-103-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-101-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-99-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-97-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-95-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-93-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-91-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-81-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-78-0x0000000000800000-0x0000000000813000-memory.dmp

    Filesize

    76KB

  • memory/436-77-0x0000000000800000-0x0000000000818000-memory.dmp

    Filesize

    96KB

  • memory/436-75-0x0000000004B90000-0x0000000004BD0000-memory.dmp

    Filesize

    256KB

  • memory/436-76-0x0000000004B90000-0x0000000004BD0000-memory.dmp

    Filesize

    256KB

  • memory/436-74-0x00000000003D0000-0x00000000003EA000-memory.dmp

    Filesize

    104KB

  • memory/1812-119-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-135-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-116-0x0000000004980000-0x00000000049BC000-memory.dmp

    Filesize

    240KB

  • memory/1812-118-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-127-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-125-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-123-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-131-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-129-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-133-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-121-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-117-0x0000000004A00000-0x0000000004A3A000-memory.dmp

    Filesize

    232KB

  • memory/1812-137-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-139-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-141-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-143-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-145-0x0000000002C20000-0x0000000002C66000-memory.dmp

    Filesize

    280KB

  • memory/1812-150-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-154-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-152-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-148-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-146-0x0000000004A00000-0x0000000004A35000-memory.dmp

    Filesize

    212KB

  • memory/1812-911-0x00000000049C0000-0x0000000004A00000-memory.dmp

    Filesize

    256KB

  • memory/1812-914-0x00000000049C0000-0x0000000004A00000-memory.dmp

    Filesize

    256KB