Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-03-2024 10:18
Behavioral task
behavioral1
Sample
b72d429d1d690165c7b0de4a074c4a58.exe
Resource
win7-20240221-en
General
-
Target
b72d429d1d690165c7b0de4a074c4a58.exe
-
Size
117KB
-
MD5
b72d429d1d690165c7b0de4a074c4a58
-
SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565
-
SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
-
SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c
-
SSDEEP
3072:qwS9xonGdoFlC5w/oV9RRKyfKW63beFEKyBFfa1:5CeSKyRPfKWybi1
Malware Config
Extracted
blacknet
v3.7.0 Public
Bot
http://furyx.de/panel
BN[c1916af6f3a468e5b6f5c7f6b9c78982]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
true
Signatures
-
BlackNET payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2692-0-0x0000000000100000-0x0000000000122000-memory.dmp family_blacknet C:\Windows\Microsoft\MyClient\WindowsUpdate.exe family_blacknet behavioral1/memory/584-38-0x0000000000C50000-0x0000000000C72000-memory.dmp family_blacknet -
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2692-0-0x0000000000100000-0x0000000000122000-memory.dmp disable_win_def C:\Windows\Microsoft\MyClient\WindowsUpdate.exe disable_win_def behavioral1/memory/584-38-0x0000000000C50000-0x0000000000C72000-memory.dmp disable_win_def -
Processes:
b72d429d1d690165c7b0de4a074c4a58.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b72d429d1d690165c7b0de4a074c4a58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b72d429d1d690165c7b0de4a074c4a58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b72d429d1d690165c7b0de4a074c4a58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b72d429d1d690165c7b0de4a074c4a58.exe -
Executes dropped EXE 1 IoCs
Processes:
WindowsUpdate.exepid process 584 WindowsUpdate.exe -
Processes:
b72d429d1d690165c7b0de4a074c4a58.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features b72d429d1d690165c7b0de4a074c4a58.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Windows\\Microsoft\\MyClient\\WindowsUpdate.exe" b72d429d1d690165c7b0de4a074c4a58.exe -
Drops file in Windows directory 2 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exedescription ioc process File created C:\Windows\Microsoft\MyClient\WindowsUpdate.exe b72d429d1d690165c7b0de4a074c4a58.exe File opened for modification C:\Windows\Microsoft\MyClient\WindowsUpdate.exe b72d429d1d690165c7b0de4a074c4a58.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exepowershell.exepid process 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2552 powershell.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exepowershell.exeWindowsUpdate.exedescription pid process Token: SeDebugPrivilege 2692 b72d429d1d690165c7b0de4a074c4a58.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 584 WindowsUpdate.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exeWindowsUpdate.exepid process 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 2692 b72d429d1d690165c7b0de4a074c4a58.exe 584 WindowsUpdate.exe 584 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exedescription pid process target process PID 2692 wrote to memory of 2552 2692 b72d429d1d690165c7b0de4a074c4a58.exe powershell.exe PID 2692 wrote to memory of 2552 2692 b72d429d1d690165c7b0de4a074c4a58.exe powershell.exe PID 2692 wrote to memory of 2552 2692 b72d429d1d690165c7b0de4a074c4a58.exe powershell.exe PID 2692 wrote to memory of 2436 2692 b72d429d1d690165c7b0de4a074c4a58.exe schtasks.exe PID 2692 wrote to memory of 2436 2692 b72d429d1d690165c7b0de4a074c4a58.exe schtasks.exe PID 2692 wrote to memory of 2436 2692 b72d429d1d690165c7b0de4a074c4a58.exe schtasks.exe PID 2692 wrote to memory of 380 2692 b72d429d1d690165c7b0de4a074c4a58.exe WerFault.exe PID 2692 wrote to memory of 380 2692 b72d429d1d690165c7b0de4a074c4a58.exe WerFault.exe PID 2692 wrote to memory of 380 2692 b72d429d1d690165c7b0de4a074c4a58.exe WerFault.exe PID 2692 wrote to memory of 584 2692 b72d429d1d690165c7b0de4a074c4a58.exe WindowsUpdate.exe PID 2692 wrote to memory of 584 2692 b72d429d1d690165c7b0de4a074c4a58.exe WindowsUpdate.exe PID 2692 wrote to memory of 584 2692 b72d429d1d690165c7b0de4a074c4a58.exe WindowsUpdate.exe PID 2692 wrote to memory of 784 2692 b72d429d1d690165c7b0de4a074c4a58.exe schtasks.exe PID 2692 wrote to memory of 784 2692 b72d429d1d690165c7b0de4a074c4a58.exe schtasks.exe PID 2692 wrote to memory of 784 2692 b72d429d1d690165c7b0de4a074c4a58.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b72d429d1d690165c7b0de4a074c4a58.exe"C:\Users\Admin\AppData\Local\Temp\b72d429d1d690165c7b0de4a074c4a58.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"schtasks" /delete /tn "WindowsUpdate.exe" /f2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2692 -s 10762⤵
-
C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Microsoft\MyClient\WindowsUpdate.exeFilesize
117KB
MD5b72d429d1d690165c7b0de4a074c4a58
SHA1f0704d227482a80f2f90dab79ed4acd9770fe565
SHA256b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
SHA512f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c
-
memory/584-46-0x000007FEF5D30000-0x000007FEF671C000-memory.dmpFilesize
9.9MB
-
memory/584-42-0x000000001AE50000-0x000000001AED0000-memory.dmpFilesize
512KB
-
memory/584-43-0x000000001AE50000-0x000000001AED0000-memory.dmpFilesize
512KB
-
memory/584-45-0x000000001AE50000-0x000000001AED0000-memory.dmpFilesize
512KB
-
memory/584-44-0x000000001AE50000-0x000000001AED0000-memory.dmpFilesize
512KB
-
memory/584-40-0x000007FEF5D30000-0x000007FEF671C000-memory.dmpFilesize
9.9MB
-
memory/584-38-0x0000000000C50000-0x0000000000C72000-memory.dmpFilesize
136KB
-
memory/2552-14-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/2552-13-0x000007FEEE250000-0x000007FEEEBED000-memory.dmpFilesize
9.6MB
-
memory/2552-9-0x000000001B370000-0x000000001B652000-memory.dmpFilesize
2.9MB
-
memory/2552-15-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/2552-16-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/2552-17-0x000007FEEE250000-0x000007FEEEBED000-memory.dmpFilesize
9.6MB
-
memory/2552-10-0x0000000002390000-0x0000000002398000-memory.dmpFilesize
32KB
-
memory/2552-11-0x000007FEEE250000-0x000007FEEEBED000-memory.dmpFilesize
9.6MB
-
memory/2552-12-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/2692-19-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-18-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-23-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-24-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-26-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-25-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-28-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-27-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-32-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-36-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-21-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-20-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-39-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-22-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-29-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-41-0x000007FEF5D30000-0x000007FEF671C000-memory.dmpFilesize
9.9MB
-
memory/2692-0-0x0000000000100000-0x0000000000122000-memory.dmpFilesize
136KB
-
memory/2692-4-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-3-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-2-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-1-0x000007FEF5D30000-0x000007FEF671C000-memory.dmpFilesize
9.9MB
-
memory/2692-47-0x00000000002C0000-0x0000000000340000-memory.dmpFilesize
512KB
-
memory/2692-48-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-50-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB
-
memory/2692-49-0x000000001F820000-0x000000001F920000-memory.dmpFilesize
1024KB