Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
db5268c43d753b67233bef775db184b7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
db5268c43d753b67233bef775db184b7.exe
Resource
win10v2004-20230915-en
General
-
Target
db5268c43d753b67233bef775db184b7.exe
-
Size
1.2MB
-
MD5
db5268c43d753b67233bef775db184b7
-
SHA1
c65d3a36915a9f54be30611334b6387e96329bce
-
SHA256
629241c8629ef1de31f6a3c44238a1a80f6181d73dec9a21be18c8247ae2185f
-
SHA512
c1bd01986df6b78f061ea7159fb51d90fea1333716b0aa63b0bd1e5e9d4f47c3f3f09ab6fa46b87efa32bcfeeb2ce78ef57bba27577b8dc2def6d1c47ed8df25
-
SSDEEP
24576:Fyj5HO2btCiTFzOd273jji+ao1DcU9z2hHsEKSO+lQgUmHpk2gSf5LcEpGgvKvpQ:gjN/4i5zn3n9aoFh9zA2Sx9LpFgS5cEB
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 2456 nc0ST66.exe 2332 YZ3HP62.exe 2764 zA8Sk17.exe 2620 1kA40ES0.exe -
Loads dropped DLL 12 IoCs
pid Process 1348 db5268c43d753b67233bef775db184b7.exe 2456 nc0ST66.exe 2456 nc0ST66.exe 2332 YZ3HP62.exe 2332 YZ3HP62.exe 2764 zA8Sk17.exe 2764 zA8Sk17.exe 2620 1kA40ES0.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zA8Sk17.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" db5268c43d753b67233bef775db184b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nc0ST66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" YZ3HP62.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2620 set thread context of 2840 2620 1kA40ES0.exe 33 -
Program crash 1 IoCs
pid pid_target Process procid_target 2536 2620 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2840 AppLaunch.exe 2840 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2840 AppLaunch.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 1348 wrote to memory of 2456 1348 db5268c43d753b67233bef775db184b7.exe 28 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2456 wrote to memory of 2332 2456 nc0ST66.exe 29 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2332 wrote to memory of 2764 2332 YZ3HP62.exe 30 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2764 wrote to memory of 2620 2764 zA8Sk17.exe 31 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2612 2620 1kA40ES0.exe 32 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2840 2620 1kA40ES0.exe 33 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34 PID 2620 wrote to memory of 2536 2620 1kA40ES0.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5268c43d753b67233bef775db184b7.exe"C:\Users\Admin\AppData\Local\Temp\db5268c43d753b67233bef775db184b7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nc0ST66.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YZ3HP62.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zA8Sk17.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kA40ES0.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2612
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 2806⤵
- Loads dropped DLL
- Program crash
PID:2536
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
1.1MB
MD57277c7f58ab32a173a94dc3841cb0eaf
SHA1cbfde0aa8f66ddaa431e0b613c7cf4d2c88e9cfb
SHA25619e32c071eb08ac418fc5f5074dc1c7179a88a1bd4b86ba42c30dd0265909ab7
SHA51297ad226b85ee809ba24f6348ab83ad38d831412371296bf5e8ec55430b4ab1bb9f195e4d12bf05b47dfd573d368c7d4c00b2531ff9c165614030769ff2c2f62d
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
690KB
MD5bd8c5b198b9dc09709cde41b375c57c9
SHA16442d2aeef42eb4299a942e51a1bdf24d4e016a7
SHA256acf74279398cea73abde823b950d0f4c8fbf5790f25c24248cab5b4ba2de2321
SHA512fea07e5129dff4df77c587c432908b8b9c1c5ec735aff40e9c2cf2efcff7f4216bf5dbe6053b3c0794eda12879bea43a4bdf2662979871cb130ada3fdb48c77c
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
330KB
MD5c675af41b0d362b58e8796d97ef637f0
SHA1d70dff9c2c678eb036f051bf8ec89d25169d8a18
SHA256b8a131ce8a4b47d2dedd85359f76fc971d233ecc3c02911df0e4a2f9c58358ac
SHA5129ee27776faebaf2e896b3d8141f4c2be0b3cc00e1fe82fc97f1532b3451900c7fd9eecb5b7afdad8405b0110b3af09c325f9ae08baf24580eeddf0080e41a9b3
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81