Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
06/10/2023, 09:25
Static task
static1
Behavioral task
behavioral1
Sample
a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe
Resource
win10-20230831-en
General
-
Target
a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe
-
Size
1.8MB
-
MD5
fdb81886ae7c656822136d957db873a4
-
SHA1
b102d88e64e3e6df1a1da415e0d9f490ba160820
-
SHA256
a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18
-
SHA512
bd6e7c834d4d9b4bf9fe36283fb433897774d7ed4dd43276942c0ab4ef14f7c1924c18ee7d323adf75e3bbc0fcddc4d3067bbb38e0ac721d1703650cc9cf5e52
-
SSDEEP
49152:2mgjMzHehaTQvMlY2f77KE9SfJLTfyth:9lMJeD7t9sy7
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2848 dZ2hX48.exe 876 RK5ZG46.exe 4356 nW3Fn11.exe 4340 1WB63rK8.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" RK5ZG46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" nW3Fn11.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" dZ2hX48.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4340 set thread context of 3096 4340 1WB63rK8.exe 74 -
Program crash 1 IoCs
pid pid_target Process procid_target 3604 4340 WerFault.exe 73 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3096 AppLaunch.exe 3096 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3096 AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2848 2776 a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe 70 PID 2776 wrote to memory of 2848 2776 a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe 70 PID 2776 wrote to memory of 2848 2776 a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe 70 PID 2848 wrote to memory of 876 2848 dZ2hX48.exe 71 PID 2848 wrote to memory of 876 2848 dZ2hX48.exe 71 PID 2848 wrote to memory of 876 2848 dZ2hX48.exe 71 PID 876 wrote to memory of 4356 876 RK5ZG46.exe 72 PID 876 wrote to memory of 4356 876 RK5ZG46.exe 72 PID 876 wrote to memory of 4356 876 RK5ZG46.exe 72 PID 4356 wrote to memory of 4340 4356 nW3Fn11.exe 73 PID 4356 wrote to memory of 4340 4356 nW3Fn11.exe 73 PID 4356 wrote to memory of 4340 4356 nW3Fn11.exe 73 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74 PID 4340 wrote to memory of 3096 4340 1WB63rK8.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe"C:\Users\Admin\AppData\Local\Temp\a3787d1e7c003d843f375b411d66eddcd371ece6c4ad795b8c6207a47c8a4d18.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dZ2hX48.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dZ2hX48.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RK5ZG46.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RK5ZG46.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nW3Fn11.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nW3Fn11.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1WB63rK8.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1WB63rK8.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5606⤵
- Program crash
PID:3604
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD55b5dcd726536a650afc41e69d5d3dfa1
SHA13a9bac0573becaf624cf565f753480eb1ad0b9b6
SHA2567081fbdf34a88389a2dad55d951e43c690658663b2b560800ba089986977e718
SHA512edd908692deb6d60797c509cab29be6b0a02f8e786727ac64c287648e9e6386f43e6bc6a3ba5d682719cfc81f0ed687fff45ae55467274c2e873591319b9d546
-
Filesize
1.7MB
MD55b5dcd726536a650afc41e69d5d3dfa1
SHA13a9bac0573becaf624cf565f753480eb1ad0b9b6
SHA2567081fbdf34a88389a2dad55d951e43c690658663b2b560800ba089986977e718
SHA512edd908692deb6d60797c509cab29be6b0a02f8e786727ac64c287648e9e6386f43e6bc6a3ba5d682719cfc81f0ed687fff45ae55467274c2e873591319b9d546
-
Filesize
1.2MB
MD5941cd7ae5c24433db9f8966ab713f530
SHA126500a6eb00f64b81160b75b011b921c092cb97b
SHA256547e69c90de37a991cb7d42c146049af77768163b69f30d97f842d22a269c175
SHA512e556c90132cad33f81939d3347de23bb79ce2462dcd527e2966405f0867920da0af86c2772cc98c424243382f4626f15ab3222a44c34d49c360ff3af56dbd344
-
Filesize
1.2MB
MD5941cd7ae5c24433db9f8966ab713f530
SHA126500a6eb00f64b81160b75b011b921c092cb97b
SHA256547e69c90de37a991cb7d42c146049af77768163b69f30d97f842d22a269c175
SHA512e556c90132cad33f81939d3347de23bb79ce2462dcd527e2966405f0867920da0af86c2772cc98c424243382f4626f15ab3222a44c34d49c360ff3af56dbd344
-
Filesize
725KB
MD562b4275e1c81b947d8ec0051b4a74426
SHA13c7d19a5f18c741ae07501edf59ed030b7d44acb
SHA256bf4c91c619936ba4426f723c1afcccd01078e9adf1b315c0e11c729730a6c1bf
SHA512313077119552a8a289e93256389d8812cc90d06b12361f81e5e507fdf4ec7c2445436aaab91efb1db205b318e9254a809eb9895811e2e596582457ba2016ea50
-
Filesize
725KB
MD562b4275e1c81b947d8ec0051b4a74426
SHA13c7d19a5f18c741ae07501edf59ed030b7d44acb
SHA256bf4c91c619936ba4426f723c1afcccd01078e9adf1b315c0e11c729730a6c1bf
SHA512313077119552a8a289e93256389d8812cc90d06b12361f81e5e507fdf4ec7c2445436aaab91efb1db205b318e9254a809eb9895811e2e596582457ba2016ea50
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158
-
Filesize
1.8MB
MD5ca7a5693b5b0e8b54d6dad6a5b1b86b5
SHA149da08ec9be5e002b0d22dd630182c3a905c76c7
SHA2562d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12
SHA51268ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158