Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 07:55
Static task
static1
Behavioral task
behavioral1
Sample
b6e95ff23f2e0793f36543b91d0d0a0a.exe
Resource
win7-20240221-en
General
-
Target
b6e95ff23f2e0793f36543b91d0d0a0a.exe
-
Size
409KB
-
MD5
b6e95ff23f2e0793f36543b91d0d0a0a
-
SHA1
072c8321280f2ceded6a906724ca974875f41146
-
SHA256
b826af3338b2d2f0c6b5427ba25a47661ca142e9f331b6443255f359c44036fe
-
SHA512
4a8a8242f86aee5c2efca76298965ddfe0af48d761c6bbd9a648f78f591db72033aa804d3d066b63a99e6a3499fdd61475b09be36238f5bc993285d1e1fda4c5
-
SSDEEP
6144:0t76RZpCr6xDmBKUtCcgQm3qOjgsVP/RG4vDuK8tFAnpLL/Y6afliNiqxm:0p6o6xDuFtdwjBLG4buJgtY6iqI
Malware Config
Extracted
arkei
185.224.139.233/MwJRWa1FHk.php
Signatures
-
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Nirsoft 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\AdvancedRun.exe Nirsoft -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AdvancedRun.exeb6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation AdvancedRun.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1548 AdvancedRun.exe 2004 AdvancedRun.exe -
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection b6e95ff23f2e0793f36543b91d0d0a0a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exedescription pid process target process PID 4804 set thread context of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exepid process 1548 AdvancedRun.exe 1548 AdvancedRun.exe 1548 AdvancedRun.exe 1548 AdvancedRun.exe 2004 AdvancedRun.exe 2004 AdvancedRun.exe 2004 AdvancedRun.exe 2004 AdvancedRun.exe 3080 powershell.exe 3080 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeb6e95ff23f2e0793f36543b91d0d0a0a.exepowershell.exedescription pid process Token: SeDebugPrivilege 1548 AdvancedRun.exe Token: SeImpersonatePrivilege 1548 AdvancedRun.exe Token: SeDebugPrivilege 2004 AdvancedRun.exe Token: SeImpersonatePrivilege 2004 AdvancedRun.exe Token: SeDebugPrivilege 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe Token: SeDebugPrivilege 3080 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
b6e95ff23f2e0793f36543b91d0d0a0a.exeAdvancedRun.exedescription pid process target process PID 4804 wrote to memory of 1548 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 4804 wrote to memory of 1548 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 4804 wrote to memory of 1548 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe AdvancedRun.exe PID 1548 wrote to memory of 2004 1548 AdvancedRun.exe AdvancedRun.exe PID 1548 wrote to memory of 2004 1548 AdvancedRun.exe AdvancedRun.exe PID 1548 wrote to memory of 2004 1548 AdvancedRun.exe AdvancedRun.exe PID 4804 wrote to memory of 3080 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 4804 wrote to memory of 3080 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 4804 wrote to memory of 3080 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe powershell.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe PID 4804 wrote to memory of 3152 4804 b6e95ff23f2e0793f36543b91d0d0a0a.exe b6e95ff23f2e0793f36543b91d0d0a0a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\AdvancedRun.exe" /SpecialRun 4101d8 15483⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"C:\Users\Admin\AppData\Local\Temp\b6e95ff23f2e0793f36543b91d0d0a0a.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\419f21b1-2d68-4d82-8c82-8451583c203d\AdvancedRun.exeFilesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_luqs54oq.ocv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3080-65-0x00000000076B0000-0x0000000007D2A000-memory.dmpFilesize
6.5MB
-
memory/3080-32-0x0000000002440000-0x0000000002450000-memory.dmpFilesize
64KB
-
memory/3080-47-0x0000000005950000-0x0000000005CA4000-memory.dmpFilesize
3.3MB
-
memory/3080-64-0x0000000006D80000-0x0000000006E23000-memory.dmpFilesize
652KB
-
memory/3080-76-0x0000000074920000-0x00000000750D0000-memory.dmpFilesize
7.7MB
-
memory/3080-73-0x0000000007380000-0x0000000007388000-memory.dmpFilesize
32KB
-
memory/3080-72-0x00000000073A0000-0x00000000073BA000-memory.dmpFilesize
104KB
-
memory/3080-42-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/3080-71-0x00000000072A0000-0x00000000072B4000-memory.dmpFilesize
80KB
-
memory/3080-63-0x0000000006300000-0x000000000631E000-memory.dmpFilesize
120KB
-
memory/3080-30-0x0000000002450000-0x0000000002486000-memory.dmpFilesize
216KB
-
memory/3080-29-0x0000000002440000-0x0000000002450000-memory.dmpFilesize
64KB
-
memory/3080-35-0x00000000055A0000-0x00000000055C2000-memory.dmpFilesize
136KB
-
memory/3080-53-0x00000000711E0000-0x000000007122C000-memory.dmpFilesize
304KB
-
memory/3080-26-0x0000000074920000-0x00000000750D0000-memory.dmpFilesize
7.7MB
-
memory/3080-66-0x0000000007060000-0x000000000707A000-memory.dmpFilesize
104KB
-
memory/3080-70-0x0000000007290000-0x000000000729E000-memory.dmpFilesize
56KB
-
memory/3080-34-0x0000000004F40000-0x0000000005568000-memory.dmpFilesize
6.2MB
-
memory/3080-69-0x0000000007260000-0x0000000007271000-memory.dmpFilesize
68KB
-
memory/3080-41-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/3080-52-0x0000000006330000-0x0000000006362000-memory.dmpFilesize
200KB
-
memory/3080-68-0x00000000072E0000-0x0000000007376000-memory.dmpFilesize
600KB
-
memory/3080-67-0x00000000070D0000-0x00000000070DA000-memory.dmpFilesize
40KB
-
memory/3080-48-0x0000000005D50000-0x0000000005D6E000-memory.dmpFilesize
120KB
-
memory/3080-49-0x0000000005DA0000-0x0000000005DEC000-memory.dmpFilesize
304KB
-
memory/3080-50-0x0000000002440000-0x0000000002450000-memory.dmpFilesize
64KB
-
memory/3080-51-0x000000007F890000-0x000000007F8A0000-memory.dmpFilesize
64KB
-
memory/3152-31-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3152-28-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3152-24-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3152-77-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4804-9-0x0000000005290000-0x00000000052AE000-memory.dmpFilesize
120KB
-
memory/4804-0-0x00000000006D0000-0x000000000073C000-memory.dmpFilesize
432KB
-
memory/4804-4-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/4804-3-0x0000000005070000-0x0000000005102000-memory.dmpFilesize
584KB
-
memory/4804-1-0x0000000074920000-0x00000000750D0000-memory.dmpFilesize
7.7MB
-
memory/4804-33-0x0000000074920000-0x00000000750D0000-memory.dmpFilesize
7.7MB
-
memory/4804-2-0x0000000005580000-0x0000000005B24000-memory.dmpFilesize
5.6MB
-
memory/4804-8-0x0000000005200000-0x0000000005268000-memory.dmpFilesize
416KB
-
memory/4804-7-0x0000000005360000-0x00000000053D6000-memory.dmpFilesize
472KB
-
memory/4804-6-0x00000000052C0000-0x000000000535C000-memory.dmpFilesize
624KB
-
memory/4804-5-0x0000000005000000-0x000000000500A000-memory.dmpFilesize
40KB