6670375665846207a54883a038d31d79b304465c1969115b52c035ff168d01a9

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe
Size

1.4MB
MD5

7a7e98c4be9e144627fd3ac850542930
SHA1

1883b0491959d70958df504e1347d9ce5548ac86
SHA256

5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab
SHA512

027f8d722ca1dcd70e4327397bd571965b9eab6bd65496b194ce20b954d65276c6012ea0b7a0250e60e20ec38f10f6796358b1e982217c9cf78d8fc3c4f68684
SSDEEP

24576:jtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5PQTx9p:RqTytRFk6ek1Py

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysbrapsvc.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	267306160.exe

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
2560	16DB.exe
2568	246915620.exe
1652	sysbrapsvc.exe
1460	1012314472.exe
2116	267306160.exe
2092	2448514943.exe
2912	1924038785.exe
2768	3862929807.exe

Loads dropped DLL 9 IoCs

pid	Process
1632	5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe
2560	16DB.exe
2560	16DB.exe
1652	sysbrapsvc.exe
1652	sysbrapsvc.exe
1652	sysbrapsvc.exe
2116	267306160.exe
2116	267306160.exe
2116	267306160.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	267306160.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysbrapsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysbrapsvc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysbrapsvc.exe"	246915620.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winploravr.exe"	267306160.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winploravr.exe"	267306160.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winploravr.exe	267306160.exe
File created	C:\Windows\sysbrapsvc.exe	246915620.exe
File opened for modification	C:\Windows\sysbrapsvc.exe	246915620.exe
File created	C:\Windows\winploravr.exe	267306160.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2560	1632	5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe	28
PID 1632 wrote to memory of 2560	1632	5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe	28
PID 1632 wrote to memory of 2560	1632	5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe	28
PID 1632 wrote to memory of 2560	1632	5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe	28
PID 2560 wrote to memory of 2568	2560	16DB.exe	30
PID 2560 wrote to memory of 2568	2560	16DB.exe	30
PID 2560 wrote to memory of 2568	2560	16DB.exe	30
PID 2560 wrote to memory of 2568	2560	16DB.exe	30
PID 2568 wrote to memory of 1652	2568	246915620.exe	31
PID 2568 wrote to memory of 1652	2568	246915620.exe	31
PID 2568 wrote to memory of 1652	2568	246915620.exe	31
PID 2568 wrote to memory of 1652	2568	246915620.exe	31
PID 1652 wrote to memory of 1460	1652	sysbrapsvc.exe	33
PID 1652 wrote to memory of 1460	1652	sysbrapsvc.exe	33
PID 1652 wrote to memory of 1460	1652	sysbrapsvc.exe	33
PID 1652 wrote to memory of 1460	1652	sysbrapsvc.exe	33
PID 1652 wrote to memory of 2116	1652	sysbrapsvc.exe	34
PID 1652 wrote to memory of 2116	1652	sysbrapsvc.exe	34
PID 1652 wrote to memory of 2116	1652	sysbrapsvc.exe	34
PID 1652 wrote to memory of 2116	1652	sysbrapsvc.exe	34
PID 2116 wrote to memory of 2092	2116	267306160.exe	36
PID 2116 wrote to memory of 2092	2116	267306160.exe	36
PID 2116 wrote to memory of 2092	2116	267306160.exe	36
PID 2116 wrote to memory of 2092	2116	267306160.exe	36
PID 2116 wrote to memory of 2912	2116	267306160.exe	37
PID 2116 wrote to memory of 2912	2116	267306160.exe	37
PID 2116 wrote to memory of 2912	2116	267306160.exe	37
PID 2116 wrote to memory of 2912	2116	267306160.exe	37
PID 2116 wrote to memory of 2768	2116	267306160.exe	40
PID 2116 wrote to memory of 2768	2116	267306160.exe	40
PID 2116 wrote to memory of 2768	2116	267306160.exe	40
PID 2116 wrote to memory of 2768	2116	267306160.exe	40

C:\Users\Admin\AppData\Local\Temp\5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe
"C:\Users\Admin\AppData\Local\Temp\5b5c0d7feffc99467bb9d50d403644da22310551597af3eb2566922415be88ab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\16DB.exe
  "C:\Users\Admin\AppData\Local\Temp\16DB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\246915620.exe
    C:\Users\Admin\AppData\Local\Temp\246915620.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\sysbrapsvc.exe
      C:\Windows\sysbrapsvc.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\1012314472.exe
        
        C:\Users\Admin\AppData\Local\Temp\1012314472.exe
        5⤵
        Executes dropped EXE
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\267306160.exe
        
        C:\Users\Admin\AppData\Local\Temp\267306160.exe
        5⤵
        Windows security bypass
        Executes dropped EXE
        Loads dropped DLL
        Windows security modification
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\2448514943.exe
        
        C:\Users\Admin\AppData\Local\Temp\2448514943.exe
        6⤵
        Executes dropped EXE
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\1924038785.exe
        
        C:\Users\Admin\AppData\Local\Temp\1924038785.exe
        6⤵
        Executes dropped EXE
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\3862929807.exe
        
        C:\Users\Admin\AppData\Local\Temp\3862929807.exe
        6⤵
        Executes dropped EXE
        
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MEFTDE7Q\_3[1]

Filesize
9KB

MD5
4c12165bc335a32cb559c828484a86a6

SHA1
c2e78c57f15a1a3a190be415aac3d1e3209ce785

SHA256
4831bd83c39ec9d898ccc1023858c81a03326b7c1c5dd8e24fdf9b2171707d1a

SHA512
f44df78b6f16255496b2fa35e28c185011c2bebf47730a68fd1369abf87f390684a8786a167319319d14a12da3768c1edef8e36037cde339a1ffe8c62c3ea87b

Download Submit
\Users\Admin\AppData\Local\Temp\16DB.exe

Filesize
10KB

MD5
f33c75710d0e0463a2528e619c2ee382

SHA1
4d2dd071fe274e6a8696448c21eeeecc0cf07e6d

SHA256
ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9

SHA512
154242d9880aa6a4f56e697643da089db121fcb1fb8fe7748efed650a6446d259be45aa58ec76f447d2c4bb5649f01acd2304d86321ec8720dfa1182ce0d5bfe

Download Submit
\Users\Admin\AppData\Local\Temp\2448514943.exe

Filesize
8KB

MD5
9b8a3fb66b93c24c52e9c68633b00f37

SHA1
2a9290e32d1582217eac32b977961ada243ada9a

SHA256
8a169cf165f635ecb6c55cacecb2c202c5fc6ef5fa82ec9cdb7d4b0300f35293

SHA512
117da1ec9850212e4cafce6669c2cfffc8078627f5c3ccdfd6a1bf3bee2d351290071087a4c206578d23852fa5e69c2ebefd71905c85b1eaed4220932bb71a39

Download Submit
\Users\Admin\AppData\Local\Temp\246915620.exe

Filesize
98KB

MD5
0a547347b0b9af0290b263dfa8d71ebe

SHA1
5ff176bfe5e0255a68c8e3d132afbff795a1fc1d

SHA256
b00aa26d9d7889613c7552ce6e17b0264788e24c6166edcf68c47f209ca767f8

SHA512
8e3795bc46783f970c63c56d340e1eb47346bd3e7a9050ed7d1fac77cdcf96e9ec2a955d56b60ca68556a160ab4c0116b2a51d0bbee91c5ded72a3b2b81d5fb0

Download Submit
\Users\Admin\AppData\Local\Temp\267306160.exe

Filesize
14KB

MD5
d085f41fe497a63dc2a4882b485a2caf

SHA1
9dc111412129833495f19d7b8a5500cf7284ad68

SHA256
fb11b4e2d26812e26ea7428f3b0b9bb8a16814188250fa60697c7aec40a49bd0

SHA512
ed4d8e297094248fb536154ed0427f4cc1832f339ce29d0f782971ede42fa2b9e5f953f73e71d0cfc026e5fd2ec0f7062410af359fd940a14f277adca37fc106

Download Submit
memory/1632-8-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/1632-26-0x0000000000400000-0x0000000000576DB0-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads