Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23-08-2023 18:36
Behavioral task
behavioral1
Sample
1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Resource
win10v2004-20230703-en
General
-
Target
1fb97ee37a2c5a979bc4dff4613f9fb2.exe
-
Size
93KB
-
MD5
1fb97ee37a2c5a979bc4dff4613f9fb2
-
SHA1
13679e8eb6e8995bfda6590f3dd04c6d99104b67
-
SHA256
c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8
-
SHA512
913f3b430ea169ae91079a65982b15b913c89ee9eb43eb15a09bb44f052e27597e598017b1c3cc47b2633e8ef9c9b5f056e447beb5b61f3453e2280c0c52a727
-
SSDEEP
1536:ghnR8lZc+/2HK1j+58dljEwzGi1dDUDPgS:ghnKc+/2HK1a8dSi1dyo
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 2944 netsh.exe 2188 netsh.exe 2940 netsh.exe -
Drops startup file 6 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af200c2dc24146f167c6cde4523f107fSteam.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af200c2dc24146f167c6cde4523f107fSteam.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription ioc process File created C:\Windows\SysWOW64\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Windows\SysWOW64\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Drops file in Program Files directory 2 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription ioc process File created C:\Program Files (x86)\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Program Files (x86)\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exepid process 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exepid process 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription pid process Token: SeDebugPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: 33 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe Token: SeIncBasePriorityPrivilege 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription pid process target process PID 2560 wrote to memory of 2188 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2188 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2188 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2188 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2940 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2940 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2940 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2940 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2944 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2944 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2944 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 2560 wrote to memory of 2944 2560 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe" "1fb97ee37a2c5a979bc4dff4613f9fb2.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe" "1fb97ee37a2c5a979bc4dff4613f9fb2.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Explower.exeFilesize
93KB
MD51fb97ee37a2c5a979bc4dff4613f9fb2
SHA113679e8eb6e8995bfda6590f3dd04c6d99104b67
SHA256c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8
SHA512913f3b430ea169ae91079a65982b15b913c89ee9eb43eb15a09bb44f052e27597e598017b1c3cc47b2633e8ef9c9b5f056e447beb5b61f3453e2280c0c52a727
-
memory/2560-0-0x0000000074070000-0x000000007461B000-memory.dmpFilesize
5.7MB
-
memory/2560-2-0x00000000007A0000-0x00000000007E0000-memory.dmpFilesize
256KB
-
memory/2560-1-0x0000000074070000-0x000000007461B000-memory.dmpFilesize
5.7MB
-
memory/2560-19-0x0000000074070000-0x000000007461B000-memory.dmpFilesize
5.7MB
-
memory/2560-20-0x0000000074070000-0x000000007461B000-memory.dmpFilesize
5.7MB