Analysis

  • max time kernel
    151s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 02:43

General

  • Target

    624674655afa629fc13f57d22b61365c3c2f4ba19e6d75c0ece9d6060ff17feb.exe

  • Size

    1.5MB

  • MD5

    c7800a107b2dc2e9c2239edbb231a76d

  • SHA1

    708288f539d1c3757fbec6ecdc38f6f86dbc3005

  • SHA256

    624674655afa629fc13f57d22b61365c3c2f4ba19e6d75c0ece9d6060ff17feb

  • SHA512

    e7fc451b4af7ae2e1cef22d8d88a9d814c7f97129feb031a2511521bc255e7768a5bda7a2cbdc1c34b6715a987d5b81c24175da6322092b89d406661ada80d15

  • SSDEEP

    24576:fyq4dKniwanjI3qrw1tniVqB0qB7JuYXI0FJM+cXjLF6jI3cmknYFcaC:qVYUjI3wAtiQ0ilJM+Mj0nYFf

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\624674655afa629fc13f57d22b61365c3c2f4ba19e6d75c0ece9d6060ff17feb.exe
    "C:\Users\Admin\AppData\Local\Temp\624674655afa629fc13f57d22b61365c3c2f4ba19e6d75c0ece9d6060ff17feb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za312718.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za312718.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3844
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za140910.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za140910.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za697502.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za697502.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\13057769.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\13057769.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3176
            • C:\Windows\Temp\1.exe
              "C:\Windows\Temp\1.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1080
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u77580895.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u77580895.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1876
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 1264
              6⤵
              • Program crash
              PID:4912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1876 -ip 1876
    1⤵
      PID:3728

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za312718.exe
      Filesize

      1.3MB

      MD5

      57df57deedccfdd567f4abebf204fbb6

      SHA1

      d06c603135b97179f70528a199174930bfc0449c

      SHA256

      15a9c52bed85661cb81ed863f0fc554c5741103780fde7943c53ab0550ee3343

      SHA512

      46b098e2009a43df84d7f24a54600a52fa2028e818aeac794560fe6f8506b5781355d57e55cfcda816494da207822a1be9e66fc0512cf0ba4a855c32911815f3

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za312718.exe
      Filesize

      1.3MB

      MD5

      57df57deedccfdd567f4abebf204fbb6

      SHA1

      d06c603135b97179f70528a199174930bfc0449c

      SHA256

      15a9c52bed85661cb81ed863f0fc554c5741103780fde7943c53ab0550ee3343

      SHA512

      46b098e2009a43df84d7f24a54600a52fa2028e818aeac794560fe6f8506b5781355d57e55cfcda816494da207822a1be9e66fc0512cf0ba4a855c32911815f3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za140910.exe
      Filesize

      862KB

      MD5

      61bf6798a10bbd9cc23aa57397b1c124

      SHA1

      a77975a58266a9e6ffc159b5495d0d3755826eac

      SHA256

      26f5eb40e8b5c21860eb9c1e0bd3fdebb7fffa3a2b449c639dbb711721785df1

      SHA512

      4c2e193ca1f02926df5ad56a40632dc66d5f2bb0698fc5eb6476816b4dbdc34db0e63e6029881129c4b808a61702b3c9ca637a3d288492337bfc8dcb4ec9aaa2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za140910.exe
      Filesize

      862KB

      MD5

      61bf6798a10bbd9cc23aa57397b1c124

      SHA1

      a77975a58266a9e6ffc159b5495d0d3755826eac

      SHA256

      26f5eb40e8b5c21860eb9c1e0bd3fdebb7fffa3a2b449c639dbb711721785df1

      SHA512

      4c2e193ca1f02926df5ad56a40632dc66d5f2bb0698fc5eb6476816b4dbdc34db0e63e6029881129c4b808a61702b3c9ca637a3d288492337bfc8dcb4ec9aaa2

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za697502.exe
      Filesize

      679KB

      MD5

      baf6ec787b86e81ddcd297211c7a9cf4

      SHA1

      bd199466f7ead973b0b62ba4a308c7265609e77b

      SHA256

      53e6bc58925cf5f419b69a4e22613908c5195054a2d6383ec487ffea4171027d

      SHA512

      9ea64febb32e5aadb43ab648fdbd4c0cb46cbd8e173bc4d0144cf92a00b4a0c1a843e8d499a00458036c574c82f417ee3b6ef8f8174cb09418d211b0e1f5abb0

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za697502.exe
      Filesize

      679KB

      MD5

      baf6ec787b86e81ddcd297211c7a9cf4

      SHA1

      bd199466f7ead973b0b62ba4a308c7265609e77b

      SHA256

      53e6bc58925cf5f419b69a4e22613908c5195054a2d6383ec487ffea4171027d

      SHA512

      9ea64febb32e5aadb43ab648fdbd4c0cb46cbd8e173bc4d0144cf92a00b4a0c1a843e8d499a00458036c574c82f417ee3b6ef8f8174cb09418d211b0e1f5abb0

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\13057769.exe
      Filesize

      302KB

      MD5

      e17a6e4bcf21cc3b96b9cd57a62650bf

      SHA1

      f1b123446c37cecceca1e6b500fc9bd038a88d98

      SHA256

      80e9f378445cfd91cbecc19d5bf9a36f9a3771e9c6a9b9b740489b444d97f9be

      SHA512

      f8e3c2c8bd66e005e5b5b141594c9630e449059a5be8343fb6190ffb126230dfe911a78a6610aa8e2506634e119914e3c1da0609e7af87e779ed3756b871d561

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\13057769.exe
      Filesize

      302KB

      MD5

      e17a6e4bcf21cc3b96b9cd57a62650bf

      SHA1

      f1b123446c37cecceca1e6b500fc9bd038a88d98

      SHA256

      80e9f378445cfd91cbecc19d5bf9a36f9a3771e9c6a9b9b740489b444d97f9be

      SHA512

      f8e3c2c8bd66e005e5b5b141594c9630e449059a5be8343fb6190ffb126230dfe911a78a6610aa8e2506634e119914e3c1da0609e7af87e779ed3756b871d561

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u77580895.exe
      Filesize

      516KB

      MD5

      971d911ed55320923b7204696efc0c01

      SHA1

      d6f37d90651e92f4e21b29b37741b7217196d19e

      SHA256

      481146d930b89238da414799bd7c55ebc3b34ab0156170ba1d04be829d598822

      SHA512

      4105a06ebe1716086043ad34ef04eb2c2e662d124c2edf0173811607210a3747b9080dab5be414faf40381712bd7017e81a5599a0412b7cbe559838b61a5448e

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u77580895.exe
      Filesize

      516KB

      MD5

      971d911ed55320923b7204696efc0c01

      SHA1

      d6f37d90651e92f4e21b29b37741b7217196d19e

      SHA256

      481146d930b89238da414799bd7c55ebc3b34ab0156170ba1d04be829d598822

      SHA512

      4105a06ebe1716086043ad34ef04eb2c2e662d124c2edf0173811607210a3747b9080dab5be414faf40381712bd7017e81a5599a0412b7cbe559838b61a5448e

    • C:\Windows\Temp\1.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Windows\Temp\1.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Windows\Temp\1.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • memory/1080-2312-0x00000000002E0000-0x00000000002EA000-memory.dmp
      Filesize

      40KB

    • memory/1876-4450-0x0000000004F80000-0x0000000004F90000-memory.dmp
      Filesize

      64KB

    • memory/1876-2600-0x0000000004F80000-0x0000000004F90000-memory.dmp
      Filesize

      64KB

    • memory/1876-2314-0x0000000000900000-0x000000000094C000-memory.dmp
      Filesize

      304KB

    • memory/1876-2601-0x0000000004F80000-0x0000000004F90000-memory.dmp
      Filesize

      64KB

    • memory/1876-4445-0x0000000004F80000-0x0000000004F90000-memory.dmp
      Filesize

      64KB

    • memory/1876-4447-0x0000000000900000-0x000000000094C000-memory.dmp
      Filesize

      304KB

    • memory/1876-4449-0x0000000004F80000-0x0000000004F90000-memory.dmp
      Filesize

      64KB

    • memory/1876-4451-0x0000000005710000-0x00000000057A2000-memory.dmp
      Filesize

      584KB

    • memory/1876-4453-0x0000000004F80000-0x0000000004F90000-memory.dmp
      Filesize

      64KB

    • memory/3176-204-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-228-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-190-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-192-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-194-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-196-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-198-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-200-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-202-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-186-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-206-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-208-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-210-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-214-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-212-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-216-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-218-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-220-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-222-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-224-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-226-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-188-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-2294-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-2293-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-2295-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-2297-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-184-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-180-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-182-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-178-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-176-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-174-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-172-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-170-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-166-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-167-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-168-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-165-0x0000000004A90000-0x0000000004AA0000-memory.dmp
      Filesize

      64KB

    • memory/3176-163-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-162-0x00000000050B0000-0x0000000005101000-memory.dmp
      Filesize

      324KB

    • memory/3176-161-0x0000000004B00000-0x00000000050A4000-memory.dmp
      Filesize

      5.6MB