Analysis
-
max time kernel
184s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 23:20
Static task
static1
Behavioral task
behavioral1
Sample
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe
Resource
win10v2004-20230220-en
General
-
Target
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe
-
Size
1.5MB
-
MD5
2e667dec3dea82de02ed6b0d947672d4
-
SHA1
025e2c59034345a5c86acc8b04f70c0eaf82ea56
-
SHA256
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1
-
SHA512
2deb511ba513f4ca97639eed541ef73045fcdbb25b3b2ee51904b7d07c5aaec2f87cf38191ace33975e2bb9e2452a6eb92dedb2d4e4f9c5521a43bb9f920661a
-
SSDEEP
24576:wyUhKIa1M21gfKXfxEXf4tuDZy7tw+QiOrekk8EOBobGV8fg1uMKPeGOxmjys3kC:3UKIOAK+XQtYo7trQiOreYPoqVyg8MKS
Malware Config
Signatures
-
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
61254245.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation 61254245.exe -
Executes dropped EXE 6 IoCs
Processes:
za705935.exeza732301.exeza987971.exe61254245.exe1.exeu96726410.exepid process 4920 za705935.exe 4864 za732301.exe 3368 za987971.exe 212 61254245.exe 1620 1.exe 4372 u96726410.exe -
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exeza705935.exeza732301.exeza987971.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za705935.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za705935.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za732301.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za732301.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za987971.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" za987971.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3296 4372 WerFault.exe u96726410.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1.exepid process 1620 1.exe 1620 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
61254245.exe1.exeu96726410.exedescription pid process Token: SeDebugPrivilege 212 61254245.exe Token: SeDebugPrivilege 1620 1.exe Token: SeDebugPrivilege 4372 u96726410.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exeza705935.exeza732301.exeza987971.exe61254245.exedescription pid process target process PID 3140 wrote to memory of 4920 3140 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe za705935.exe PID 3140 wrote to memory of 4920 3140 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe za705935.exe PID 3140 wrote to memory of 4920 3140 13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe za705935.exe PID 4920 wrote to memory of 4864 4920 za705935.exe za732301.exe PID 4920 wrote to memory of 4864 4920 za705935.exe za732301.exe PID 4920 wrote to memory of 4864 4920 za705935.exe za732301.exe PID 4864 wrote to memory of 3368 4864 za732301.exe za987971.exe PID 4864 wrote to memory of 3368 4864 za732301.exe za987971.exe PID 4864 wrote to memory of 3368 4864 za732301.exe za987971.exe PID 3368 wrote to memory of 212 3368 za987971.exe 61254245.exe PID 3368 wrote to memory of 212 3368 za987971.exe 61254245.exe PID 3368 wrote to memory of 212 3368 za987971.exe 61254245.exe PID 212 wrote to memory of 1620 212 61254245.exe 1.exe PID 212 wrote to memory of 1620 212 61254245.exe 1.exe PID 3368 wrote to memory of 4372 3368 za987971.exe u96726410.exe PID 3368 wrote to memory of 4372 3368 za987971.exe u96726410.exe PID 3368 wrote to memory of 4372 3368 za987971.exe u96726410.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe"C:\Users\Admin\AppData\Local\Temp\13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 12206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4372 -ip 43721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exeFilesize
1.3MB
MD5b3aabd99d980821be458cbd7c49f86dc
SHA1d4e0758dff28ffcf545fd3cd5b068e73b45a3a49
SHA256db5b8f7721f8527aaaa0536424f17b479355dea95d38b73743b2499178d70265
SHA512f230a46a89df5698dd6eb5211c8c68eae8a36ad49b0dffb785a14fce3e2927e88921ca5a665eb90759cad8e4c60eebcef5ad6557bd05cc9c80b3b898978e5ed9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za705935.exeFilesize
1.3MB
MD5b3aabd99d980821be458cbd7c49f86dc
SHA1d4e0758dff28ffcf545fd3cd5b068e73b45a3a49
SHA256db5b8f7721f8527aaaa0536424f17b479355dea95d38b73743b2499178d70265
SHA512f230a46a89df5698dd6eb5211c8c68eae8a36ad49b0dffb785a14fce3e2927e88921ca5a665eb90759cad8e4c60eebcef5ad6557bd05cc9c80b3b898978e5ed9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exeFilesize
883KB
MD56613bfaa73c1333ca6d7b9890d7be937
SHA1631ce1e5756201411ef975f6976f90dc1770a17d
SHA256812e02c698cbf8f3a9d833795340293b0494bb5bee82b27561d9157c4d908f2e
SHA51245f1b9d7bb1cbd26a54b26e70490c3713bb732a27fb28c7351190306c364e08da88d2e5f886f5ce086ab9199bd4dd49295b1f2284f57a6c645c816306303cc5a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za732301.exeFilesize
883KB
MD56613bfaa73c1333ca6d7b9890d7be937
SHA1631ce1e5756201411ef975f6976f90dc1770a17d
SHA256812e02c698cbf8f3a9d833795340293b0494bb5bee82b27561d9157c4d908f2e
SHA51245f1b9d7bb1cbd26a54b26e70490c3713bb732a27fb28c7351190306c364e08da88d2e5f886f5ce086ab9199bd4dd49295b1f2284f57a6c645c816306303cc5a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exeFilesize
700KB
MD5d923c2563c879731fc6d237a66153786
SHA16384057028e92e704b29260a864e1433c64f6762
SHA256b2f05fccc0eb5039125fd07dd7f89e9822146934bcd190a318aa09246b63cffd
SHA5128d8e6c24864fa6521a3a6345613e014e01a5e9d384e1d4ba5bc2a22dc6f00a09b4eb689cca413f644af2a9c441d041f8b660b80086aac539ac550a4651dc80ad
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za987971.exeFilesize
700KB
MD5d923c2563c879731fc6d237a66153786
SHA16384057028e92e704b29260a864e1433c64f6762
SHA256b2f05fccc0eb5039125fd07dd7f89e9822146934bcd190a318aa09246b63cffd
SHA5128d8e6c24864fa6521a3a6345613e014e01a5e9d384e1d4ba5bc2a22dc6f00a09b4eb689cca413f644af2a9c441d041f8b660b80086aac539ac550a4651dc80ad
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exeFilesize
300KB
MD58391bc437772a29ffae4b769790faa1c
SHA13b9455bd00427e49e4cedfbffa7bb95106e34513
SHA25672eddd576652c5c8a1fd2007adad7c4e89e183b734246001e6c48a988b0506e6
SHA512d5d187c1e907587a1df6e63875b4d6dac7e4f286cad041b5d0bd2297a2d3e6f110f2d88d3658d488174e30a8b1c6e9e9f009d4653d9d6f28d88069f64348ccb4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\61254245.exeFilesize
300KB
MD58391bc437772a29ffae4b769790faa1c
SHA13b9455bd00427e49e4cedfbffa7bb95106e34513
SHA25672eddd576652c5c8a1fd2007adad7c4e89e183b734246001e6c48a988b0506e6
SHA512d5d187c1e907587a1df6e63875b4d6dac7e4f286cad041b5d0bd2297a2d3e6f110f2d88d3658d488174e30a8b1c6e9e9f009d4653d9d6f28d88069f64348ccb4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exeFilesize
479KB
MD5a5aa16ba2e76316f61fe263668916ad9
SHA11ea67ce94b55acd959f60fe9d8377298912d14e8
SHA256a651273804f0dcecfb4a5ac3ac8a94fd2570512d9e5765cb525a09ef2e47efe1
SHA5124d3ba814bdf6fbafe5f84a54f3df7c927fb0d8b75d3341e38d30bba9ce5e13c80735b8c73fc76b2c0cbcf1406a545c44c27793170d80ec23eafb9a1219e041eb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u96726410.exeFilesize
479KB
MD5a5aa16ba2e76316f61fe263668916ad9
SHA11ea67ce94b55acd959f60fe9d8377298912d14e8
SHA256a651273804f0dcecfb4a5ac3ac8a94fd2570512d9e5765cb525a09ef2e47efe1
SHA5124d3ba814bdf6fbafe5f84a54f3df7c927fb0d8b75d3341e38d30bba9ce5e13c80735b8c73fc76b2c0cbcf1406a545c44c27793170d80ec23eafb9a1219e041eb
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
memory/212-204-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-218-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-168-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-174-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-176-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-180-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-178-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-182-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-184-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-186-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-188-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/212-190-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/212-192-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-189-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-194-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-196-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-198-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-200-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-202-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-170-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-208-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-210-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-206-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-212-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-214-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-172-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-216-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-220-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-222-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-224-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-226-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-228-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-2294-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/212-166-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-2302-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/212-2303-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/212-164-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-163-0x0000000004FC0000-0x0000000005011000-memory.dmpFilesize
324KB
-
memory/212-162-0x0000000004A10000-0x0000000004FB4000-memory.dmpFilesize
5.6MB
-
memory/212-161-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/1620-2311-0x0000000000C20000-0x0000000000C2A000-memory.dmpFilesize
40KB
-
memory/4372-2598-0x0000000000820000-0x000000000086C000-memory.dmpFilesize
304KB
-
memory/4372-2599-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-2604-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-2602-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-4446-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-4448-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-4447-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-4449-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-4451-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4372-4454-0x00000000059E0000-0x0000000005A72000-memory.dmpFilesize
584KB