Analysis
-
max time kernel
4s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2023 18:38
Behavioral task
behavioral1
Sample
1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1fb97ee37a2c5a979bc4dff4613f9fb2.exe
Resource
win10v2004-20230703-en
General
-
Target
1fb97ee37a2c5a979bc4dff4613f9fb2.exe
-
Size
93KB
-
MD5
1fb97ee37a2c5a979bc4dff4613f9fb2
-
SHA1
13679e8eb6e8995bfda6590f3dd04c6d99104b67
-
SHA256
c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8
-
SHA512
913f3b430ea169ae91079a65982b15b913c89ee9eb43eb15a09bb44f052e27597e598017b1c3cc47b2633e8ef9c9b5f056e447beb5b61f3453e2280c0c52a727
-
SSDEEP
1536:ghnR8lZc+/2HK1j+58dljEwzGi1dDUDPgS:ghnKc+/2HK1a8dSi1dyo
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 1716 netsh.exe 2156 netsh.exe 964 netsh.exe -
Drops startup file 6 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af200c2dc24146f167c6cde4523f107fSteam.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af200c2dc24146f167c6cde4523f107fSteam.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Drops file in System32 directory 2 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription ioc process File created C:\Windows\SysWOW64\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Windows\SysWOW64\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Drops file in Program Files directory 2 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription ioc process File created C:\Program Files (x86)\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe File opened for modification C:\Program Files (x86)\Explower.exe 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exepid process 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription pid process Token: SeDebugPrivilege 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1fb97ee37a2c5a979bc4dff4613f9fb2.exedescription pid process target process PID 4328 wrote to memory of 1716 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 1716 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 1716 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 2156 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 2156 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 2156 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 964 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 964 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe PID 4328 wrote to memory of 964 4328 1fb97ee37a2c5a979bc4dff4613f9fb2.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe" "1fb97ee37a2c5a979bc4dff4613f9fb2.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe"2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1fb97ee37a2c5a979bc4dff4613f9fb2.exe" "1fb97ee37a2c5a979bc4dff4613f9fb2.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exeFilesize
93KB
MD51fb97ee37a2c5a979bc4dff4613f9fb2
SHA113679e8eb6e8995bfda6590f3dd04c6d99104b67
SHA256c4edeb1befa9d2125c24938dfa1ac106d35f6992793a5ebc8c2b09ec38777ca8
SHA512913f3b430ea169ae91079a65982b15b913c89ee9eb43eb15a09bb44f052e27597e598017b1c3cc47b2633e8ef9c9b5f056e447beb5b61f3453e2280c0c52a727
-
memory/4328-0-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/4328-1-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/4328-2-0x0000000000D40000-0x0000000000D50000-memory.dmpFilesize
64KB