Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2023 21:45

General

  • Target

    file.exe

  • Size

    1.2MB

  • MD5

    ae6bcbf4dc011c51606da631ad289c40

  • SHA1

    63c0cecd9cb56b51de089ffa8becf1803add964b

  • SHA256

    3c53812acc6c7331c2bd86c8f29e3500b040c945ebdbcaec4e8b0fb63e9b6aa3

  • SHA512

    cdfafe4358c48d6f40d67a62b3ad8f319cba0164af7c2c9327494d6a72718ed615c957987501cc9449aa7dd64a09e61c4bc9d17b536852300e2070a3e422cabf

  • SSDEEP

    24576:Hy0oTwhjrwoMWdjcXAdaybDk/2nPEGIAiXrmhNgOEYd76pqyEllFoea7/:S0oTwhjMoTdo6a5uPhIDXCjUYZ6pqyEY

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3028
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 268
                7⤵
                • Program crash
                PID:1568
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

    Filesize

    1.0MB

    MD5

    329da0069bb2125b78e45b5248d186ed

    SHA1

    c2fd67c3c0d5dd1904827cbed13c674d86952d5f

    SHA256

    1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

    SHA512

    36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

    Filesize

    1.0MB

    MD5

    329da0069bb2125b78e45b5248d186ed

    SHA1

    c2fd67c3c0d5dd1904827cbed13c674d86952d5f

    SHA256

    1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

    SHA512

    36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

    Filesize

    745KB

    MD5

    1c28ec10c263eab4b6413b280d108d46

    SHA1

    bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

    SHA256

    5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

    SHA512

    5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

    Filesize

    745KB

    MD5

    1c28ec10c263eab4b6413b280d108d46

    SHA1

    bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

    SHA256

    5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

    SHA512

    5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

    Filesize

    494KB

    MD5

    7dbda2a911a3c08bc3ac4539e4096cf6

    SHA1

    033907f8b2bf668cf2ab1de228e14ab2d490041a

    SHA256

    aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

    SHA512

    e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

    Filesize

    494KB

    MD5

    7dbda2a911a3c08bc3ac4539e4096cf6

    SHA1

    033907f8b2bf668cf2ab1de228e14ab2d490041a

    SHA256

    aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

    SHA512

    e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

    Filesize

    1.0MB

    MD5

    329da0069bb2125b78e45b5248d186ed

    SHA1

    c2fd67c3c0d5dd1904827cbed13c674d86952d5f

    SHA256

    1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

    SHA512

    36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\CB4DQ66.exe

    Filesize

    1.0MB

    MD5

    329da0069bb2125b78e45b5248d186ed

    SHA1

    c2fd67c3c0d5dd1904827cbed13c674d86952d5f

    SHA256

    1356cdbb022ed71041a0b779f53eee900f40771bffdadfb0493891af537d1159

    SHA512

    36062bc46d78240e5c2b39fc9b3a389c5dc97f76c834e90bae64b73c09a9db6318e1e8b2ff223dcf0d8814e13267c4bf1b44178668ad5cf132892ed3484c4fdf

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

    Filesize

    745KB

    MD5

    1c28ec10c263eab4b6413b280d108d46

    SHA1

    bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

    SHA256

    5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

    SHA512

    5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\Ds1MV99.exe

    Filesize

    745KB

    MD5

    1c28ec10c263eab4b6413b280d108d46

    SHA1

    bb5d7812bbb014f58057d0dfbb9e596db44f6cc7

    SHA256

    5c101224df6e71cda990eb4ab5427034bcd4f7451cb86aa77b05c170ea83f9be

    SHA512

    5b86e70ca49bfa68463003e758284bab973c65be7b849190d766f5bbd879ed237bc6516575d717d10966696323282e34ed0ecd829cfab86543b3951ff2479670

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

    Filesize

    494KB

    MD5

    7dbda2a911a3c08bc3ac4539e4096cf6

    SHA1

    033907f8b2bf668cf2ab1de228e14ab2d490041a

    SHA256

    aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

    SHA512

    e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\op2bt28.exe

    Filesize

    494KB

    MD5

    7dbda2a911a3c08bc3ac4539e4096cf6

    SHA1

    033907f8b2bf668cf2ab1de228e14ab2d490041a

    SHA256

    aacb49d435e7f0c6b2f7affe3a670bdc5c3917ce25e8f68d4b561877a85b8da5

    SHA512

    e8c7b9d0447794d200ec68adca5612dabc4c9ac6e4f7f1a0727011da499ee8a53f03a1a27e577a45cb726903d89bba21110e474e38b3da24cfee5433eb6a1329

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1jJ44zT3.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2wC4075.exe

    Filesize

    448KB

    MD5

    eb224ab4447fd162331de829a25cd323

    SHA1

    bc548105ff28c7df16c2bad188e84347ac545fac

    SHA256

    2297046a8c31790163a45d192afd48fc77260888829587fec5b72fe52cf489f0

    SHA512

    212ca1b198b858f9ef012cf691ea579657711601e5e26aa673650d40248b4576c7cab718a02f58ca2ee7000e2cc479fcbbe37f06358f33066205838e19df913c

  • memory/2784-42-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-43-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-65-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-63-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-61-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-57-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-55-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-51-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-49-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-67-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-45-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-41-0x0000000001F10000-0x0000000001F2C000-memory.dmp

    Filesize

    112KB

  • memory/2784-40-0x00000000003E0000-0x00000000003FE000-memory.dmp

    Filesize

    120KB

  • memory/2784-69-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-47-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-53-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/2784-59-0x0000000001F10000-0x0000000001F26000-memory.dmp

    Filesize

    88KB

  • memory/3028-77-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-80-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-78-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-76-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-85-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-87-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-83-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-81-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3028-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/3028-79-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB