ed862f9b9cd6b1e574b1c64b13b41d744ed79ab6a04e36308e844b7aa413bda6

Analysis

max time kernel
191s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 876KB
Sample231014-ya8d3sda55
SHA256 ed862f9b9cd6b1e574b1c64b13b41d744ed79ab6a04e36308e844b7aa413bda6
MD5 0ef27491000a33fca2c1c4da35a79f25
SHA1 5e3244c98206c1abab86ca53ced95871cc5f408f
SHA512 6da13a54ce08a91bc2516f186ed57dd27d0f3de92150976e91e21d1c159ec0e3bc389c4ff39fd23c3574c54cf1a71e7c4406a3e23242d8c51e534e2fe0a262b4
SSDEEP 12288:TMr/y90W18/YcqhbXw+CWT/sBykUvje93rtW8i5MbQmuxnI5ph6DZcKwI1RQbyT:Ay7g3qB1T/yUQI8i5MUmenkpPKIyT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

Executes dropped EXE 4 IoCs

pid	Process
4064	pw0Lk24.exe
208	QK9Ga77.exe
4216	iL6Wi28.exe
1872	1FW51Iy9.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	pw0Lk24.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	QK9Ga77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	iL6Wi28.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1708	1872	1FW51Iy9.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	1872	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	AppLaunch.exe
1708	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	AppLaunch.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4064	4344	file.exe	82
PID 4344 wrote to memory of 4064	4344	file.exe	82
PID 4344 wrote to memory of 4064	4344	file.exe	82
PID 4064 wrote to memory of 208	4064	pw0Lk24.exe	83
PID 4064 wrote to memory of 208	4064	pw0Lk24.exe	83
PID 4064 wrote to memory of 208	4064	pw0Lk24.exe	83
PID 208 wrote to memory of 4216	208	QK9Ga77.exe	84
PID 208 wrote to memory of 4216	208	QK9Ga77.exe	84
PID 208 wrote to memory of 4216	208	QK9Ga77.exe	84
PID 4216 wrote to memory of 1872	4216	iL6Wi28.exe	85
PID 4216 wrote to memory of 1872	4216	iL6Wi28.exe	85
PID 4216 wrote to memory of 1872	4216	iL6Wi28.exe	85
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86
PID 1872 wrote to memory of 1708	1872	1FW51Iy9.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pw0Lk24.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pw0Lk24.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QK9Ga77.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QK9Ga77.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iL6Wi28.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iL6Wi28.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1FW51Iy9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1FW51Iy9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 552
        6⤵
        Program crash
        
        PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1872 -ip 1872
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pw0Lk24.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pw0Lk24.exe
Size 738KB
SHA256 41f5c89fe51314801a1a3b44c2c1ba0d6e7d608b321ebad8dfb1457e69ba4c6d
MD5 a55e8d5d77b37fd169fc9fcfff9f3c9e
SHA1 1b4321bbf045ff0a609341de6814a35472d1dc41
SHA512 ee33070f168c4d5e34d038ba5fccdfba2cba89792bf524fb0ba11ee904d87fd79d771fb52a172c32e00c81ba0ab7ec351b00497d364eea604927b28359932a54
SSDEEP 12288:nMrPy90iO9Coc/5RcEYe93rJxRi5MDQmHEnI5phsDZGtwJ1RQD:EywCoicyjRi5MMmknkpLtz
MD5 SHA1 SHA512 SSDEEP

Submit Download

pw0Lk24.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pw0Lk24.exe
Size 738KB
SHA256 41f5c89fe51314801a1a3b44c2c1ba0d6e7d608b321ebad8dfb1457e69ba4c6d
MD5 a55e8d5d77b37fd169fc9fcfff9f3c9e
SHA1 1b4321bbf045ff0a609341de6814a35472d1dc41
SHA512 ee33070f168c4d5e34d038ba5fccdfba2cba89792bf524fb0ba11ee904d87fd79d771fb52a172c32e00c81ba0ab7ec351b00497d364eea604927b28359932a54
SSDEEP 12288:nMrPy90iO9Coc/5RcEYe93rJxRi5MDQmHEnI5phsDZGtwJ1RQD:EywCoicyjRi5MMmknkpLtz
MD5 SHA1 SHA512 SSDEEP

Submit Download

QK9Ga77.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QK9Ga77.exe
Size 502KB
SHA256 6ac6264641477b570d6ee17f7218050445f8e85fcb4a5abee48b5e8d5a85868d
MD5 aa67cb4be3bbfab470fee6c61fe98f07
SHA1 98d72aea4b2cb6d3f688489341d99034dd53e64c
SHA512 ab288980d58d40a5967120ab1b13342d178af4b9df0dbfcebc2b8993123b7629e61e1b4482c8bbbd6dd19a38de0b8fbded346ea6938476153f8212571587252d
SSDEEP 6144:Kpy+bnr+Kp0yN90QEADcxyJVZxlajkk91Noodlyoe93B+4km6nlyJEUtnki5MD0L:TMrWy90sckINrdje93kJ2ki5MKpmyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

QK9Ga77.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QK9Ga77.exe
Size 502KB
SHA256 6ac6264641477b570d6ee17f7218050445f8e85fcb4a5abee48b5e8d5a85868d
MD5 aa67cb4be3bbfab470fee6c61fe98f07
SHA1 98d72aea4b2cb6d3f688489341d99034dd53e64c
SHA512 ab288980d58d40a5967120ab1b13342d178af4b9df0dbfcebc2b8993123b7629e61e1b4482c8bbbd6dd19a38de0b8fbded346ea6938476153f8212571587252d
SSDEEP 6144:Kpy+bnr+Kp0yN90QEADcxyJVZxlajkk91Noodlyoe93B+4km6nlyJEUtnki5MD0L:TMrWy90sckINrdje93kJ2ki5MKpmyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

iL6Wi28.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iL6Wi28.exe
Size 317KB
SHA256 ad26f62b6ba14f55c865615799200a29d86f46dc434be9d38743b474a71a9b81
MD5 2980bf3c94b66f750b0eeaa11a2fe416
SHA1 0a3f3117aff166625aedde33056139f54a6c2ee0
SHA512 e2d6cbf6bcdd535da350a9a9bcc91657fb3f7d7c4d512d5135a02d95bc60b3fbe928678f3ab01db5ad30621f1a7bcd9d961de02c2caefc66889b007a70f39077
SSDEEP 6144:Kky+bnr+2p0yN90QEWDHJ4ANeS4vNaSdlioe93n+4km6ElxZE3:MMray90YzaACrdfe93+Mq
MD5 SHA1 SHA512 SSDEEP

Submit Download

iL6Wi28.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iL6Wi28.exe
Size 317KB
SHA256 ad26f62b6ba14f55c865615799200a29d86f46dc434be9d38743b474a71a9b81
MD5 2980bf3c94b66f750b0eeaa11a2fe416
SHA1 0a3f3117aff166625aedde33056139f54a6c2ee0
SHA512 e2d6cbf6bcdd535da350a9a9bcc91657fb3f7d7c4d512d5135a02d95bc60b3fbe928678f3ab01db5ad30621f1a7bcd9d961de02c2caefc66889b007a70f39077
SSDEEP 6144:Kky+bnr+2p0yN90QEWDHJ4ANeS4vNaSdlioe93n+4km6ElxZE3:MMray90YzaACrdfe93+Mq
MD5 SHA1 SHA512 SSDEEP

Submit Download

1FW51Iy9.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1FW51Iy9.exe
Size 129KB
SHA256 b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa
MD5 4ed940ea493451635145489ffbdec386
SHA1 4b5d0ba229b8ac04f753864c1170da0070673e35
SHA512 8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c
SSDEEP 3072:o+ckTAk0lBdvy5tZkvLhu0qZMUQr73bC9SYLyFwEVKKPwJ:QkEdvy54hKnhEVFPwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1FW51Iy9.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1FW51Iy9.exe
Size 129KB
SHA256 b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa
MD5 4ed940ea493451635145489ffbdec386
SHA1 4b5d0ba229b8ac04f753864c1170da0070673e35
SHA512 8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c
SSDEEP 3072:o+ckTAk0lBdvy5tZkvLhu0qZMUQr73bC9SYLyFwEVKKPwJ:QkEdvy54hKnhEVFPwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1708-28-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/1708-29-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Download

memory/1708-30-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Download

memory/1708-32-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Download