41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe
Size

3.4MB
MD5

bdf7672f76ff6397df7a0d2ffdd8575b
SHA1

3cdc2551982252f892970857d8b76ba8ade92592
SHA256

41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc
SHA512

ffd1d9b11d9f8aebdb245253dec5763d46c18765cd46c8700bff57401984cb3959d58692c48238b8a4f9f90cb6332fa13050a1ae2dbfee5faed79a70ddfe212f
SSDEEP

49152:lZmp9ZRcmMC2Mb9fjzBEnUFJrIHt/GvRHR+0Idus1RAS1PZl0gIPhcrdkrNTlBBO:7SZRcmMC2IJxEZtmLPmevhc98

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2572	sc.exe
2300	sc.exe
2596	sc.exe
2460	sc.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2592	taskkill.exe
2352	taskkill.exe
2704	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe
2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2352	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	28
PID 2824 wrote to memory of 2352	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	28
PID 2824 wrote to memory of 2352	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	28
PID 2824 wrote to memory of 2352	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	28
PID 2824 wrote to memory of 2704	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	31
PID 2824 wrote to memory of 2704	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	31
PID 2824 wrote to memory of 2704	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	31
PID 2824 wrote to memory of 2704	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	31
PID 2824 wrote to memory of 2592	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	33
PID 2824 wrote to memory of 2592	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	33
PID 2824 wrote to memory of 2592	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	33
PID 2824 wrote to memory of 2592	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	33
PID 2824 wrote to memory of 2300	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	35
PID 2824 wrote to memory of 2300	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	35
PID 2824 wrote to memory of 2300	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	35
PID 2824 wrote to memory of 2300	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	35
PID 2824 wrote to memory of 2596	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	37
PID 2824 wrote to memory of 2596	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	37
PID 2824 wrote to memory of 2596	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	37
PID 2824 wrote to memory of 2596	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	37
PID 2824 wrote to memory of 2460	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	39
PID 2824 wrote to memory of 2460	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	39
PID 2824 wrote to memory of 2460	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	39
PID 2824 wrote to memory of 2460	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	39
PID 2824 wrote to memory of 2572	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	41
PID 2824 wrote to memory of 2572	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	41
PID 2824 wrote to memory of 2572	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	41
PID 2824 wrote to memory of 2572	2824	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	41

C:\Users\Admin\AppData\Local\Temp\41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe
"C:\Users\Admin\AppData\Local\Temp\41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im NarakaBladepoint.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im NeacClient.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im StartGame.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\SysWOW64\sc.exe
  sc stop MyDriver
  2⤵
  - Launches sc.exe
  PID:2300
- C:\Windows\SysWOW64\sc.exe
  sc delete MyDriver
  2⤵
  - Launches sc.exe
  PID:2596
- C:\Windows\SysWOW64\sc.exe
  sc stop MyDriver
  2⤵
  - Launches sc.exe
  PID:2460
- C:\Windows\SysWOW64\sc.exe
  sc delete MyDriver
  2⤵
  - Launches sc.exe
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Windows 7 deprecation

Loading Replay Monitor...