Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2023 18:54

General

  • Target

    fcfc5eadfd97df15537745ce66bcce1d.exe

  • Size

    1.2MB

  • MD5

    fcfc5eadfd97df15537745ce66bcce1d

  • SHA1

    04c239695cee63fc055afa822344ee828a48719b

  • SHA256

    23d1057d7a24a15af04b9962ddd1292f8e76730443cd178d4c5e186871263b02

  • SHA512

    de2b9d8afd479c031308812e9cb70f72b5061fce309fb5c953bac026806e8809eb0990f6bb794972df196826098ba9a6f5ec3ae5d7bbcd6ca55962e78366f1bd

  • SSDEEP

    24576:Oym837jsv2b8yx1jpjb9LBldopPLoJQU9SH1tK:dmwcAHVxfdMU9SV

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcfc5eadfd97df15537745ce66bcce1d.exe
    "C:\Users\Admin\AppData\Local\Temp\fcfc5eadfd97df15537745ce66bcce1d.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jV7vS03.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jV7vS03.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\os0jU85.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\os0jU85.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LA6hp77.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LA6hp77.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gA55Ui4.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gA55Ui4.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2712
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2560
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2532
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 268
                7⤵
                • Program crash
                PID:2400
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 284
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jV7vS03.exe

    Filesize

    1.0MB

    MD5

    e8b0e04970840348061ef40a9bb05154

    SHA1

    c999b8b348d3280b2eaa64e7b303f26c26995252

    SHA256

    038a3c8efa65c219fa08c54f3f75487cea7d9cb78f2b90f8ca8d177b787fb74d

    SHA512

    4131bdc4a9e938668d919c7f80b99ebb580878c7c9f226a8651f859c77cf6a40c5c49a4591741404ff7632ed41c2145b2caee7223cea49b36c25274dcf056954

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jV7vS03.exe

    Filesize

    1.0MB

    MD5

    e8b0e04970840348061ef40a9bb05154

    SHA1

    c999b8b348d3280b2eaa64e7b303f26c26995252

    SHA256

    038a3c8efa65c219fa08c54f3f75487cea7d9cb78f2b90f8ca8d177b787fb74d

    SHA512

    4131bdc4a9e938668d919c7f80b99ebb580878c7c9f226a8651f859c77cf6a40c5c49a4591741404ff7632ed41c2145b2caee7223cea49b36c25274dcf056954

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\os0jU85.exe

    Filesize

    748KB

    MD5

    392e1d0b7f4fd76953f7a36b81db87ea

    SHA1

    01c7f5667c081197dc41a019edfdc4ecb693e6e1

    SHA256

    572a838570706d63f72597b1fbaf880c163472235331d2564155f2dc7777afab

    SHA512

    1d12126ef3ccf25bdf6a1b85cfad1a56749ad5aabc7fcb21eb4d06e3dcc002480f78fab8b6344e4c2061183a91d5073c8e898107e6017600f5d122a761bf6d49

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\os0jU85.exe

    Filesize

    748KB

    MD5

    392e1d0b7f4fd76953f7a36b81db87ea

    SHA1

    01c7f5667c081197dc41a019edfdc4ecb693e6e1

    SHA256

    572a838570706d63f72597b1fbaf880c163472235331d2564155f2dc7777afab

    SHA512

    1d12126ef3ccf25bdf6a1b85cfad1a56749ad5aabc7fcb21eb4d06e3dcc002480f78fab8b6344e4c2061183a91d5073c8e898107e6017600f5d122a761bf6d49

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LA6hp77.exe

    Filesize

    493KB

    MD5

    d72fcd2f05a63ed4f60196b1699d2118

    SHA1

    f6ee97634ad1b726a85b665fc597061d121de30e

    SHA256

    c2afeb7b99e490f67570e13c24657a92dc2950fd2b1d743bb528efbb485e5a86

    SHA512

    f4f491a27b84186528050c0de23cc2872673b70ec88b39dd87b954815aa6264ce44e3f5cff8d4276b4f4fc61d22a7285927d8bdae39c62de785b0e474f040965

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LA6hp77.exe

    Filesize

    493KB

    MD5

    d72fcd2f05a63ed4f60196b1699d2118

    SHA1

    f6ee97634ad1b726a85b665fc597061d121de30e

    SHA256

    c2afeb7b99e490f67570e13c24657a92dc2950fd2b1d743bb528efbb485e5a86

    SHA512

    f4f491a27b84186528050c0de23cc2872673b70ec88b39dd87b954815aa6264ce44e3f5cff8d4276b4f4fc61d22a7285927d8bdae39c62de785b0e474f040965

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gA55Ui4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1gA55Ui4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\jV7vS03.exe

    Filesize

    1.0MB

    MD5

    e8b0e04970840348061ef40a9bb05154

    SHA1

    c999b8b348d3280b2eaa64e7b303f26c26995252

    SHA256

    038a3c8efa65c219fa08c54f3f75487cea7d9cb78f2b90f8ca8d177b787fb74d

    SHA512

    4131bdc4a9e938668d919c7f80b99ebb580878c7c9f226a8651f859c77cf6a40c5c49a4591741404ff7632ed41c2145b2caee7223cea49b36c25274dcf056954

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\jV7vS03.exe

    Filesize

    1.0MB

    MD5

    e8b0e04970840348061ef40a9bb05154

    SHA1

    c999b8b348d3280b2eaa64e7b303f26c26995252

    SHA256

    038a3c8efa65c219fa08c54f3f75487cea7d9cb78f2b90f8ca8d177b787fb74d

    SHA512

    4131bdc4a9e938668d919c7f80b99ebb580878c7c9f226a8651f859c77cf6a40c5c49a4591741404ff7632ed41c2145b2caee7223cea49b36c25274dcf056954

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\os0jU85.exe

    Filesize

    748KB

    MD5

    392e1d0b7f4fd76953f7a36b81db87ea

    SHA1

    01c7f5667c081197dc41a019edfdc4ecb693e6e1

    SHA256

    572a838570706d63f72597b1fbaf880c163472235331d2564155f2dc7777afab

    SHA512

    1d12126ef3ccf25bdf6a1b85cfad1a56749ad5aabc7fcb21eb4d06e3dcc002480f78fab8b6344e4c2061183a91d5073c8e898107e6017600f5d122a761bf6d49

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\os0jU85.exe

    Filesize

    748KB

    MD5

    392e1d0b7f4fd76953f7a36b81db87ea

    SHA1

    01c7f5667c081197dc41a019edfdc4ecb693e6e1

    SHA256

    572a838570706d63f72597b1fbaf880c163472235331d2564155f2dc7777afab

    SHA512

    1d12126ef3ccf25bdf6a1b85cfad1a56749ad5aabc7fcb21eb4d06e3dcc002480f78fab8b6344e4c2061183a91d5073c8e898107e6017600f5d122a761bf6d49

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\LA6hp77.exe

    Filesize

    493KB

    MD5

    d72fcd2f05a63ed4f60196b1699d2118

    SHA1

    f6ee97634ad1b726a85b665fc597061d121de30e

    SHA256

    c2afeb7b99e490f67570e13c24657a92dc2950fd2b1d743bb528efbb485e5a86

    SHA512

    f4f491a27b84186528050c0de23cc2872673b70ec88b39dd87b954815aa6264ce44e3f5cff8d4276b4f4fc61d22a7285927d8bdae39c62de785b0e474f040965

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\LA6hp77.exe

    Filesize

    493KB

    MD5

    d72fcd2f05a63ed4f60196b1699d2118

    SHA1

    f6ee97634ad1b726a85b665fc597061d121de30e

    SHA256

    c2afeb7b99e490f67570e13c24657a92dc2950fd2b1d743bb528efbb485e5a86

    SHA512

    f4f491a27b84186528050c0de23cc2872673b70ec88b39dd87b954815aa6264ce44e3f5cff8d4276b4f4fc61d22a7285927d8bdae39c62de785b0e474f040965

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1gA55Ui4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\1gA55Ui4.exe

    Filesize

    194KB

    MD5

    6241b03d68a610324ecda52f0f84e287

    SHA1

    da80280b6e3925e455925efd6c6e59a6118269c4

    SHA256

    ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

    SHA512

    a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\2FY8194.exe

    Filesize

    448KB

    MD5

    297e4dc54e1fa4526f4ff11aaf6df3cf

    SHA1

    55a23e94e2a3da1e2bfe1e24421bd8941b5a408e

    SHA256

    334a560865213bcb71dcc772375307f71c7966fee5937b503fd588eeaa4e2950

    SHA512

    8d39600518ee3725831512c6b93a8abc5c178c4efd9597e6eb0160672aee437c53f580b1136182a309c10fd9ee8f55f15f0ae1464f88b4317aaf2d7996cdfd12

  • memory/2532-85-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-87-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-76-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-77-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-83-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-79-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2532-81-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-80-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-78-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2712-57-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-55-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-40-0x00000000004E0000-0x00000000004FE000-memory.dmp

    Filesize

    120KB

  • memory/2712-43-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-42-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-45-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-47-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-49-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-51-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-41-0x0000000001F60000-0x0000000001F7C000-memory.dmp

    Filesize

    112KB

  • memory/2712-53-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-59-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-61-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-65-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-67-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-69-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB

  • memory/2712-63-0x0000000001F60000-0x0000000001F76000-memory.dmp

    Filesize

    88KB