Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 20:14

General

  • Target

    03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7.exe

  • Size

    653KB

  • MD5

    2f92b60f95c45ba90212f753ed335497

  • SHA1

    3d7be526c02f302020507522c684dee91a058c65

  • SHA256

    03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7

  • SHA512

    017e9dac743909dabde6ff834ecfa2dc45b6ada3d2eba7e35512c2fc02ace3d0b6528d5de70866924ef3be4779eb7e7bd94aa4bdf57c3081f137c6f2f9576c62

  • SSDEEP

    12288:0y90uZ+wYJAQ+RxMK3LZrZMDgI6RDJm2sbuHepve2PGzU3vNBGZGCRib:0yzZ+wYsyKbZ9nHJJlsqep22VvNyRib

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 11 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7.exe
    "C:\Users\Admin\AppData\Local\Temp\03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1040
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1916
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1976

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe

    Filesize

    499KB

    MD5

    f14e292dee76533c24e8e81385f93b98

    SHA1

    b6239a7452dd5a4b837aa3ba3ff7666adec12964

    SHA256

    4799bf5cc66cbb158f7b14e7bfa24519bd27f8721c240a0ce373893e59e46398

    SHA512

    3b0e90acbb2c387e6ec684cbd5690dbcffe1fb4bf886047c8d64a2519d9e79de89a3111001c8e1cabf7d2ef1b2556d3b3ede9a931a5e7636bca9ba869e7d7679

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe

    Filesize

    499KB

    MD5

    f14e292dee76533c24e8e81385f93b98

    SHA1

    b6239a7452dd5a4b837aa3ba3ff7666adec12964

    SHA256

    4799bf5cc66cbb158f7b14e7bfa24519bd27f8721c240a0ce373893e59e46398

    SHA512

    3b0e90acbb2c387e6ec684cbd5690dbcffe1fb4bf886047c8d64a2519d9e79de89a3111001c8e1cabf7d2ef1b2556d3b3ede9a931a5e7636bca9ba869e7d7679

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe

    Filesize

    499KB

    MD5

    f14e292dee76533c24e8e81385f93b98

    SHA1

    b6239a7452dd5a4b837aa3ba3ff7666adec12964

    SHA256

    4799bf5cc66cbb158f7b14e7bfa24519bd27f8721c240a0ce373893e59e46398

    SHA512

    3b0e90acbb2c387e6ec684cbd5690dbcffe1fb4bf886047c8d64a2519d9e79de89a3111001c8e1cabf7d2ef1b2556d3b3ede9a931a5e7636bca9ba869e7d7679

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe

    Filesize

    499KB

    MD5

    f14e292dee76533c24e8e81385f93b98

    SHA1

    b6239a7452dd5a4b837aa3ba3ff7666adec12964

    SHA256

    4799bf5cc66cbb158f7b14e7bfa24519bd27f8721c240a0ce373893e59e46398

    SHA512

    3b0e90acbb2c387e6ec684cbd5690dbcffe1fb4bf886047c8d64a2519d9e79de89a3111001c8e1cabf7d2ef1b2556d3b3ede9a931a5e7636bca9ba869e7d7679

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • memory/1040-75-0x0000000001DF0000-0x0000000001E08000-memory.dmp

    Filesize

    96KB

  • memory/1040-89-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-99-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-97-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-103-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-101-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-93-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-85-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-87-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-95-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-91-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-83-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-105-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-81-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-79-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-78-0x0000000001DF0000-0x0000000001E03000-memory.dmp

    Filesize

    76KB

  • memory/1040-74-0x0000000000310000-0x000000000032A000-memory.dmp

    Filesize

    104KB

  • memory/1040-77-0x00000000022B0000-0x00000000022F0000-memory.dmp

    Filesize

    256KB

  • memory/1040-76-0x00000000022B0000-0x00000000022F0000-memory.dmp

    Filesize

    256KB

  • memory/1520-121-0x0000000000270000-0x00000000002B7000-memory.dmp

    Filesize

    284KB

  • memory/1916-117-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1916-151-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-933-0x00000000048D0000-0x0000000004910000-memory.dmp

    Filesize

    256KB

  • memory/1916-118-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1916-132-0x0000000001F80000-0x0000000001FBC000-memory.dmp

    Filesize

    240KB

  • memory/1916-133-0x0000000004880000-0x00000000048BA000-memory.dmp

    Filesize

    232KB

  • memory/1916-134-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-135-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-137-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-139-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-141-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-143-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-145-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-147-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-149-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-122-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1916-153-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-155-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-157-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-159-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-161-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-163-0x0000000004880000-0x00000000048B5000-memory.dmp

    Filesize

    212KB

  • memory/1916-435-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1916-437-0x00000000048D0000-0x0000000004910000-memory.dmp

    Filesize

    256KB

  • memory/1916-439-0x00000000048D0000-0x0000000004910000-memory.dmp

    Filesize

    256KB

  • memory/1916-932-0x00000000048D0000-0x0000000004910000-memory.dmp

    Filesize

    256KB

  • memory/1916-930-0x00000000048D0000-0x0000000004910000-memory.dmp

    Filesize

    256KB

  • memory/1976-441-0x0000000000600000-0x0000000000640000-memory.dmp

    Filesize

    256KB

  • memory/1976-131-0x0000000000FC0000-0x0000000000FE8000-memory.dmp

    Filesize

    160KB