Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-03-2024 07:55
Static task
static1
Behavioral task
behavioral1
Sample
b6e95ff23f2e0793f36543b91d0d0a0a.exe
Resource
win7-20240221-en
General
-
Target
b6e95ff23f2e0793f36543b91d0d0a0a.exe
-
Size
409KB
-
MD5
b6e95ff23f2e0793f36543b91d0d0a0a
-
SHA1
072c8321280f2ceded6a906724ca974875f41146
-
SHA256
b826af3338b2d2f0c6b5427ba25a47661ca142e9f331b6443255f359c44036fe
-
SHA512
4a8a8242f86aee5c2efca76298965ddfe0af48d761c6bbd9a648f78f591db72033aa804d3d066b63a99e6a3499fdd61475b09be36238f5bc993285d1e1fda4c5
-
SSDEEP
6144:0t76RZpCr6xDmBKUtCcgQm3qOjgsVP/RG4vDuK8tFAnpLL/Y6afliNiqxm:0p6o6xDuFtdwjBLG4buJgtY6iqI
Malware Config
Extracted
arkei
185.224.139.233/MwJRWa1FHk.php
Signatures
-
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Nirsoft 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 2504 AdvancedRun.exe 2636 AdvancedRun.exe -
Loads dropped DLL 4 IoCs
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exeAdvancedRun.exepid process 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe 2504 AdvancedRun.exe 2504 AdvancedRun.exe -
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription pid process target process PID 2000 set thread context of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exepid process 2504 AdvancedRun.exe 2504 AdvancedRun.exe 2636 AdvancedRun.exe 2636 AdvancedRun.exe 2796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeb6e95ff23f2e0793f36543b91d0d0a0a.exepowershell.exedescription pid process Token: SeDebugPrivilege 2504 AdvancedRun.exe Token: SeImpersonatePrivilege 2504 AdvancedRun.exe Token: SeDebugPrivilege 2636 AdvancedRun.exe Token: SeImpersonatePrivilege 2636 AdvancedRun.exe Token: SeDebugPrivilege 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe Token: SeDebugPrivilege 2796 powershell.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exeAdvancedRun.exedescription pid process target process PID 2000 wrote to memory of 2504 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 2000 wrote to memory of 2504 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 2000 wrote to memory of 2504 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 2000 wrote to memory of 2504 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 2504 wrote to memory of 2636 2504 AdvancedRun.exe AdvancedRun.exe PID 2504 wrote to memory of 2636 2504 AdvancedRun.exe AdvancedRun.exe PID 2504 wrote to memory of 2636 2504 AdvancedRun.exe AdvancedRun.exe PID 2504 wrote to memory of 2636 2504 AdvancedRun.exe AdvancedRun.exe PID 2000 wrote to memory of 2796 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 2000 wrote to memory of 2796 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 2000 wrote to memory of 2796 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 2000 wrote to memory of 2796 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 2000 wrote to memory of 2324 2000 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\AdvancedRun.exe" /SpecialRun 4101d8 25043⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\b73ba4cb-4a1a-4759-90dc-0db8825adb3d\AdvancedRun.exeFilesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/2000-0-0x0000000000990000-0x00000000009FC000-memory.dmpFilesize
432KB
-
memory/2000-1-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2000-2-0x0000000004C30000-0x0000000004C70000-memory.dmpFilesize
256KB
-
memory/2000-3-0x0000000004140000-0x00000000041A8000-memory.dmpFilesize
416KB
-
memory/2000-42-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2324-29-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-33-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-25-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-45-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-21-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-43-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-41-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-23-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-19-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2324-37-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2324-39-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2796-36-0x0000000002930000-0x0000000002970000-memory.dmpFilesize
256KB
-
memory/2796-34-0x0000000002930000-0x0000000002970000-memory.dmpFilesize
256KB
-
memory/2796-32-0x000000006EF90000-0x000000006F53B000-memory.dmpFilesize
5.7MB
-
memory/2796-44-0x000000006EF90000-0x000000006F53B000-memory.dmpFilesize
5.7MB
-
memory/2796-30-0x000000006EF90000-0x000000006F53B000-memory.dmpFilesize
5.7MB