20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101

Analysis

max time kernel
167s
max time network
167s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe
Size

612KB
MD5

ae71d3e563721ad884a557fb65e34302
SHA1

e89e8a8b8f4fd3dcb53788bdb50f8da76812a36d
SHA256

20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101
SHA512

578102efd2ad73c0e5e24c7cedad8c3d9d18a713075258b07813f01acaa69720d62bc0a593867c740730e67e5614bbbc2a4755ae3542a975426c173ebbe2558f
SSDEEP

12288:my90ACMYuuuvLFqZ4sTgbc8pWqzPhNVB0r:my1CMY6vLFqZ4toMWQxyr

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	54356856.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	54356856.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	54356856.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	54356856.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	54356856.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	54356856.exe

Executes dropped EXE 3 IoCs

pid	Process
1672	st371918.exe
1104	54356856.exe
1028	kp522051.exe

Loads dropped DLL 6 IoCs

pid	Process
1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe
1672	st371918.exe
1672	st371918.exe
1672	st371918.exe
1672	st371918.exe
1028	kp522051.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	54356856.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	54356856.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st371918.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st371918.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	54356856.exe
1104	54356856.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	54356856.exe
Token: SeDebugPrivilege	1028	kp522051.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1268 wrote to memory of 1672	1268	20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe	28
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1104	1672	st371918.exe	29
PID 1672 wrote to memory of 1028	1672	st371918.exe	30
PID 1672 wrote to memory of 1028	1672	st371918.exe	30
PID 1672 wrote to memory of 1028	1672	st371918.exe	30
PID 1672 wrote to memory of 1028	1672	st371918.exe	30
PID 1672 wrote to memory of 1028	1672	st371918.exe	30
PID 1672 wrote to memory of 1028	1672	st371918.exe	30
PID 1672 wrote to memory of 1028	1672	st371918.exe	30

C:\Users\Admin\AppData\Local\Temp\20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe
"C:\Users\Admin\AppData\Local\Temp\20d6f321da00f58277ba97f5c147712c9f14ac4382579e0531c42b6959af7101.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st371918.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st371918.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\54356856.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\54356856.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st371918.exe

Filesize
457KB

MD5
7f6d37f83d6da7b448ffd933b05ec054

SHA1
12559ff07b43caecb3b73c756dfd55caf3015df3

SHA256
268d4667a09735ab3c9de714f746d37869807b4fc4c37df36a5e7686fd89a683

SHA512
c8a965e33646766f153db89f47adaee829caa427748e8fd3384f68a0861536776084c31b684546cddf0830ca40305e62ecf27e0c0138aafb1f6c2b2b116c9137

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st371918.exe

Filesize
457KB

MD5
7f6d37f83d6da7b448ffd933b05ec054

SHA1
12559ff07b43caecb3b73c756dfd55caf3015df3

SHA256
268d4667a09735ab3c9de714f746d37869807b4fc4c37df36a5e7686fd89a683

SHA512
c8a965e33646766f153db89f47adaee829caa427748e8fd3384f68a0861536776084c31b684546cddf0830ca40305e62ecf27e0c0138aafb1f6c2b2b116c9137

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\54356856.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\54356856.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe

Filesize
459KB

MD5
94e97df46a9dbe336f816922a37988e0

SHA1
0d5ae707a943467261abfea5951f2846e572d415

SHA256
4dbc4c1e38f85bba92d3c3b2512238f4bdcb2ca658413197e26d3f5928aa8a44

SHA512
1c4f9ae6692a06e406960c7ffefcb619afb9095f4e01187a292f22edb2ebecd592f8a5fc7a6ebf89aab33a632c8570fb64635bd7b85c09cdcda18e871e79db54

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe

Filesize
459KB

MD5
94e97df46a9dbe336f816922a37988e0

SHA1
0d5ae707a943467261abfea5951f2846e572d415

SHA256
4dbc4c1e38f85bba92d3c3b2512238f4bdcb2ca658413197e26d3f5928aa8a44

SHA512
1c4f9ae6692a06e406960c7ffefcb619afb9095f4e01187a292f22edb2ebecd592f8a5fc7a6ebf89aab33a632c8570fb64635bd7b85c09cdcda18e871e79db54

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe

Filesize
459KB

MD5
94e97df46a9dbe336f816922a37988e0

SHA1
0d5ae707a943467261abfea5951f2846e572d415

SHA256
4dbc4c1e38f85bba92d3c3b2512238f4bdcb2ca658413197e26d3f5928aa8a44

SHA512
1c4f9ae6692a06e406960c7ffefcb619afb9095f4e01187a292f22edb2ebecd592f8a5fc7a6ebf89aab33a632c8570fb64635bd7b85c09cdcda18e871e79db54

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\st371918.exe

Filesize
457KB

MD5
7f6d37f83d6da7b448ffd933b05ec054

SHA1
12559ff07b43caecb3b73c756dfd55caf3015df3

SHA256
268d4667a09735ab3c9de714f746d37869807b4fc4c37df36a5e7686fd89a683

SHA512
c8a965e33646766f153db89f47adaee829caa427748e8fd3384f68a0861536776084c31b684546cddf0830ca40305e62ecf27e0c0138aafb1f6c2b2b116c9137

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\st371918.exe

Filesize
457KB

MD5
7f6d37f83d6da7b448ffd933b05ec054

SHA1
12559ff07b43caecb3b73c756dfd55caf3015df3

SHA256
268d4667a09735ab3c9de714f746d37869807b4fc4c37df36a5e7686fd89a683

SHA512
c8a965e33646766f153db89f47adaee829caa427748e8fd3384f68a0861536776084c31b684546cddf0830ca40305e62ecf27e0c0138aafb1f6c2b2b116c9137

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\54356856.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe

Filesize
459KB

MD5
94e97df46a9dbe336f816922a37988e0

SHA1
0d5ae707a943467261abfea5951f2846e572d415

SHA256
4dbc4c1e38f85bba92d3c3b2512238f4bdcb2ca658413197e26d3f5928aa8a44

SHA512
1c4f9ae6692a06e406960c7ffefcb619afb9095f4e01187a292f22edb2ebecd592f8a5fc7a6ebf89aab33a632c8570fb64635bd7b85c09cdcda18e871e79db54

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe

Filesize
459KB

MD5
94e97df46a9dbe336f816922a37988e0

SHA1
0d5ae707a943467261abfea5951f2846e572d415

SHA256
4dbc4c1e38f85bba92d3c3b2512238f4bdcb2ca658413197e26d3f5928aa8a44

SHA512
1c4f9ae6692a06e406960c7ffefcb619afb9095f4e01187a292f22edb2ebecd592f8a5fc7a6ebf89aab33a632c8570fb64635bd7b85c09cdcda18e871e79db54

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp522051.exe

Filesize
459KB

MD5
94e97df46a9dbe336f816922a37988e0

SHA1
0d5ae707a943467261abfea5951f2846e572d415

SHA256
4dbc4c1e38f85bba92d3c3b2512238f4bdcb2ca658413197e26d3f5928aa8a44

SHA512
1c4f9ae6692a06e406960c7ffefcb619afb9095f4e01187a292f22edb2ebecd592f8a5fc7a6ebf89aab33a632c8570fb64635bd7b85c09cdcda18e871e79db54

Download Submit
memory/1028-106-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-120-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-85-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-86-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-88-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-90-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-92-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-94-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-96-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-98-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-100-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-102-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-104-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-83-0x0000000002790000-0x00000000027CC000-memory.dmp

Filesize
240KB

Download
memory/1028-108-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-110-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-112-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-114-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-116-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-124-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-122-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-84-0x00000000027D0000-0x000000000280A000-memory.dmp

Filesize
232KB

Download
memory/1028-118-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-126-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-128-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-130-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-132-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-134-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-136-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-138-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-140-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-142-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-144-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-146-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-148-0x00000000027D0000-0x0000000002805000-memory.dmp

Filesize
212KB

Download
memory/1028-340-0x0000000000240000-0x0000000000286000-memory.dmp

Filesize
280KB

Download
memory/1028-342-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1028-344-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1028-881-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1028-882-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1028-885-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1104-72-0x0000000000900000-0x000000000090A000-memory.dmp

Filesize
40KB

Download