Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe
Resource
win7-20231215-en
General
-
Target
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe
-
Size
1.3MB
-
MD5
2042fdc08ed48544a98307aec4610251
-
SHA1
50a6c64a62347c6c87abb65d04803ff23832a7e8
-
SHA256
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46
-
SHA512
b102fc8105b0a7cca5c33711e83af818dd9c37ff377d252edec69cbb05052387013426bbce38650c0360fb8c94f4796a8232b93f4c5d438caf031a50c4cae591
-
SSDEEP
24576:LXFgZi7M93fxOLHvVCGvlxcXBVDCU7EIRxCiQVhR5CUQOufa/8gU:LXFuZOraCIxghRxQRr
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/5028-30-0x00000000032D0000-0x00000000032DC000-memory.dmp disable_win_def -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exeWinServices.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation WinServices.exe -
Executes dropped EXE 2 IoCs
Processes:
ProAlts.xyz Token Generator.exeWinServices.exepid process 1476 ProAlts.xyz Token Generator.exe 5028 WinServices.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 icanhazip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WinServices.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 WinServices.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WinServices.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
WinServices.exepid process 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe 5028 WinServices.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WinServices.exedescription pid process Token: SeDebugPrivilege 5028 WinServices.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exeWinServices.execmd.exedescription pid process target process PID 2484 wrote to memory of 1476 2484 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe ProAlts.xyz Token Generator.exe PID 2484 wrote to memory of 1476 2484 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe ProAlts.xyz Token Generator.exe PID 2484 wrote to memory of 1476 2484 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe ProAlts.xyz Token Generator.exe PID 2484 wrote to memory of 5028 2484 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe WinServices.exe PID 2484 wrote to memory of 5028 2484 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe WinServices.exe PID 2484 wrote to memory of 5028 2484 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe WinServices.exe PID 5028 wrote to memory of 4528 5028 WinServices.exe cmd.exe PID 5028 wrote to memory of 4528 5028 WinServices.exe cmd.exe PID 5028 wrote to memory of 4528 5028 WinServices.exe cmd.exe PID 4528 wrote to memory of 1596 4528 cmd.exe schtasks.exe PID 4528 wrote to memory of 1596 4528 cmd.exe schtasks.exe PID 4528 wrote to memory of 1596 4528 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe"C:\Users\Admin\AppData\Local\Temp\fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WinServices.exe"C:\ProgramData\WinServices.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'4⤵
- Creates scheduled task(s)
-
C:\ProgramData\ProAlts.xyz Token Generator.exe"C:\ProgramData\ProAlts.xyz Token Generator.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ProAlts.xyz Token Generator.exeFilesize
672KB
MD52086fb707a48f239399ec752feaabd7e
SHA1bb7d8008b21a6ae038074479f6e423a257fb5260
SHA256a2cf0de9e63aeaf15700f4df455273183cf8334e732e888b0d3c1090ff84ba34
SHA512cd14867bca10f5167fd28614bb6692576b5b6807c458bef6c8ee19169daa8e713383fbfaa3cc90e4f96f3b1cbbb7dcd8ab15d105a9d435cee9fdd52046b2d5d0
-
C:\ProgramData\WinServices.exeFilesize
188KB
MD54bb3e58d375714e27744d106143cf61b
SHA1802803b91e9439c5bc0a59f73629d2a191e9f4dc
SHA256f434312e8ce38172180f281f6b3951879e82f42a07362f89179d91ded810feea
SHA51264cf58bbc58f05d6d08bdf59ce5b7496bf4a4ae97135d8a96c4ed6af7ae319a2b146d79059ff718d481f26198b1f80874fb7111c8bd79fda039e21db3f9424f7
-
C:\ProgramData\WinServices.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\CrashReport.pngFilesize
355KB
MD5f91e8aa934fb279c7901ea9fe23321e2
SHA1157251f685c5b5b2f41b9f4d2386d65b036a0a1f
SHA256b9ea96806c7afe472192ce0fd5783a39ea19276d9f8672aa54851b7f178e33b3
SHA5128ddcc4632ff396500952295ca6c7fc6d9935ab2010c07a07751afc48a2cda511d435177607c12acf0424c03a2e2ccbb6fc14bd34abf29be33cbc09628fe41414
-
memory/1476-37-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/1476-34-0x0000000005540000-0x00000000055D2000-memory.dmpFilesize
584KB
-
memory/1476-41-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/1476-27-0x0000000071B60000-0x0000000072310000-memory.dmpFilesize
7.7MB
-
memory/1476-26-0x0000000000AA0000-0x0000000000B4C000-memory.dmpFilesize
688KB
-
memory/1476-31-0x0000000005AF0000-0x0000000006094000-memory.dmpFilesize
5.6MB
-
memory/1476-47-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/1476-43-0x0000000071B60000-0x0000000072310000-memory.dmpFilesize
7.7MB
-
memory/1476-46-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/1476-36-0x0000000005600000-0x000000000560A000-memory.dmpFilesize
40KB
-
memory/2484-0-0x0000000074E10000-0x00000000753C1000-memory.dmpFilesize
5.7MB
-
memory/2484-1-0x00000000015F0000-0x0000000001600000-memory.dmpFilesize
64KB
-
memory/2484-25-0x0000000074E10000-0x00000000753C1000-memory.dmpFilesize
5.7MB
-
memory/2484-2-0x0000000074E10000-0x00000000753C1000-memory.dmpFilesize
5.7MB
-
memory/5028-33-0x0000000071B60000-0x0000000072310000-memory.dmpFilesize
7.7MB
-
memory/5028-30-0x00000000032D0000-0x00000000032DC000-memory.dmpFilesize
48KB
-
memory/5028-32-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/5028-44-0x0000000071B60000-0x0000000072310000-memory.dmpFilesize
7.7MB
-
memory/5028-45-0x00000000058E0000-0x00000000058F0000-memory.dmpFilesize
64KB
-
memory/5028-38-0x0000000006190000-0x000000000622C000-memory.dmpFilesize
624KB
-
memory/5028-35-0x00000000058E0000-0x00000000058F0000-memory.dmpFilesize
64KB
-
memory/5028-50-0x0000000006820000-0x0000000006896000-memory.dmpFilesize
472KB
-
memory/5028-51-0x0000000007860000-0x000000000787E000-memory.dmpFilesize
120KB
-
memory/5028-29-0x0000000000F50000-0x0000000000F84000-memory.dmpFilesize
208KB