Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
Resource
win10v2004-20230220-en
General
-
Target
00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe
-
Size
998KB
-
MD5
e117a2b9a45d4662173700af9f362061
-
SHA1
d9ed5a4fec5d1619768aa9a515076c5bb5a0526f
-
SHA256
00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851
-
SHA512
e5e5715955297d674b32b9939bdc93d73f5260896a8580894e5a7dfd65a2af1895b96b4744b8aa46c309dd8a410d037c3c507292622af13db02b52f8cb641117
-
SSDEEP
24576:UyUN+sJ9fZ45YsldeutPRU4CHc5yFl40:jE+Eb45YsjhtPA85
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 135164559.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 135164559.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 135164559.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 135164559.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 135164559.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 135164559.exe -
Executes dropped EXE 4 IoCs
pid Process 1620 On089268.exe 108 nL512125.exe 660 135164559.exe 984 217184863.exe -
Loads dropped DLL 10 IoCs
pid Process 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 1620 On089268.exe 1620 On089268.exe 108 nL512125.exe 108 nL512125.exe 108 nL512125.exe 660 135164559.exe 108 nL512125.exe 108 nL512125.exe 984 217184863.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 135164559.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 135164559.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce On089268.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" On089268.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce nL512125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" nL512125.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 660 135164559.exe 660 135164559.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 660 135164559.exe Token: SeDebugPrivilege 984 217184863.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1232 wrote to memory of 1620 1232 00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe 27 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 1620 wrote to memory of 108 1620 On089268.exe 28 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 660 108 nL512125.exe 29 PID 108 wrote to memory of 984 108 nL512125.exe 30 PID 108 wrote to memory of 984 108 nL512125.exe 30 PID 108 wrote to memory of 984 108 nL512125.exe 30 PID 108 wrote to memory of 984 108 nL512125.exe 30 PID 108 wrote to memory of 984 108 nL512125.exe 30 PID 108 wrote to memory of 984 108 nL512125.exe 30 PID 108 wrote to memory of 984 108 nL512125.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe"C:\Users\Admin\AppData\Local\Temp\00e3ef79b707b0e6f1390a2b1b866c41a7035bb87bddc5af92dc696391da7851.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\On089268.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nL512125.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\135164559.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\217184863.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
769KB
MD586d4ee8201163b6593a72795161ab9c5
SHA14cded56f44b1b626451c908e50055d4b8c872537
SHA2564cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1
SHA512f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d
-
Filesize
769KB
MD586d4ee8201163b6593a72795161ab9c5
SHA14cded56f44b1b626451c908e50055d4b8c872537
SHA2564cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1
SHA512f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d
-
Filesize
597KB
MD5dabd1253e492dbec394f5fa5b17fa0a3
SHA18090fdca77797e2595e9d0988bf6d116a67634be
SHA25632e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721
SHA512b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708
-
Filesize
597KB
MD5dabd1253e492dbec394f5fa5b17fa0a3
SHA18090fdca77797e2595e9d0988bf6d116a67634be
SHA25632e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721
SHA512b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708
-
Filesize
390KB
MD54b120f5da98b13dce4a2f6b2c0e3d146
SHA14698a756543b0a1e16d6154a6b615b1ea12dc21e
SHA25683edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff
SHA512ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25
-
Filesize
390KB
MD54b120f5da98b13dce4a2f6b2c0e3d146
SHA14698a756543b0a1e16d6154a6b615b1ea12dc21e
SHA25683edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff
SHA512ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25
-
Filesize
390KB
MD54b120f5da98b13dce4a2f6b2c0e3d146
SHA14698a756543b0a1e16d6154a6b615b1ea12dc21e
SHA25683edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff
SHA512ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25
-
Filesize
473KB
MD5fda72bc28d66f7a712b27e768602b0b4
SHA177704544b3c1cf1fa1d62eb585ee69538d65a914
SHA2565e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012
SHA512cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8
-
Filesize
473KB
MD5fda72bc28d66f7a712b27e768602b0b4
SHA177704544b3c1cf1fa1d62eb585ee69538d65a914
SHA2565e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012
SHA512cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8
-
Filesize
473KB
MD5fda72bc28d66f7a712b27e768602b0b4
SHA177704544b3c1cf1fa1d62eb585ee69538d65a914
SHA2565e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012
SHA512cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8
-
Filesize
769KB
MD586d4ee8201163b6593a72795161ab9c5
SHA14cded56f44b1b626451c908e50055d4b8c872537
SHA2564cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1
SHA512f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d
-
Filesize
769KB
MD586d4ee8201163b6593a72795161ab9c5
SHA14cded56f44b1b626451c908e50055d4b8c872537
SHA2564cc9b96c93f52a437fd73d1d87d598a2d0d7beac029484733352f88ac51a12f1
SHA512f9ea74aea761945c9ecfdaf5ebd0406ccca5747d75b2c85aca2be430b2f0b46c9f421051e423bc956f16f3a6bd28142b0579c10eae9a99e796a670187f1b983d
-
Filesize
597KB
MD5dabd1253e492dbec394f5fa5b17fa0a3
SHA18090fdca77797e2595e9d0988bf6d116a67634be
SHA25632e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721
SHA512b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708
-
Filesize
597KB
MD5dabd1253e492dbec394f5fa5b17fa0a3
SHA18090fdca77797e2595e9d0988bf6d116a67634be
SHA25632e77216214464f473a4edb0c2b1ffd176e4bb1535af7cb91374f67ac2b18721
SHA512b82bd7eb4848a448d2388da570949af0a1d1f2682af03e119825c68be73931eb3d522170327e07a8773394282eac2156d7c72d5f754ab619b9df3b0aa5507708
-
Filesize
390KB
MD54b120f5da98b13dce4a2f6b2c0e3d146
SHA14698a756543b0a1e16d6154a6b615b1ea12dc21e
SHA25683edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff
SHA512ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25
-
Filesize
390KB
MD54b120f5da98b13dce4a2f6b2c0e3d146
SHA14698a756543b0a1e16d6154a6b615b1ea12dc21e
SHA25683edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff
SHA512ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25
-
Filesize
390KB
MD54b120f5da98b13dce4a2f6b2c0e3d146
SHA14698a756543b0a1e16d6154a6b615b1ea12dc21e
SHA25683edaee5bc61ceb729da5bd97490e93b232962179af2db18a692e5a3c5eea7ff
SHA512ce3796736b50c8cd4be18704f00a93f3042396310f35c01c45943b4127e822948b85c6ecff95001c318345886cc3c54a3a97fb9b136047241f0ccc17a888ff25
-
Filesize
473KB
MD5fda72bc28d66f7a712b27e768602b0b4
SHA177704544b3c1cf1fa1d62eb585ee69538d65a914
SHA2565e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012
SHA512cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8
-
Filesize
473KB
MD5fda72bc28d66f7a712b27e768602b0b4
SHA177704544b3c1cf1fa1d62eb585ee69538d65a914
SHA2565e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012
SHA512cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8
-
Filesize
473KB
MD5fda72bc28d66f7a712b27e768602b0b4
SHA177704544b3c1cf1fa1d62eb585ee69538d65a914
SHA2565e902aed75445514c77fc20f0b49e1bfc207e09da2a72a505ba0ae0955b53012
SHA512cf1d8887433066b7744fb51aaea36e2c0eb7440b3cfab279de82439165ee496529b1599304538f873a35862d1bd5581080ec25c4c503715c4fc3f015144181e8