Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 22:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe
-
Size
71KB
-
MD5
4a975afe225dcf7571d1a96200d9d77e
-
SHA1
c4fcd60fe5bc1ada4a32a329790e2ffc280b1e7c
-
SHA256
4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578
-
SHA512
8cbe0aceed0beefabfadb2f8c072504373a70b87823b39f4c4a085fece7b2488e99be92707c5ee8dce4da7a1445e847ced999ee953fba78d562d0d113a36e3d5
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slJ:Olg35GTslA5t3/w8U
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ipkeroos-aced.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\ifkuxix.exe" ipkeroos-aced.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} ipkeroos-aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" ipkeroos-aced.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ipkeroos-aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ipkeroos-aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eatvoxug-eateas.exe" ipkeroos-aced.exe -
Executes dropped EXE 2 IoCs
pid Process 3728 ipkeroos-aced.exe 2820 ipkeroos-aced.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ipkeroos-aced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ipkeroos-aced.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ipkeroos-aced.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ipkeroos-aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ipkeroos-aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\exmuxod.dll" ipkeroos-aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ipkeroos-aced.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\eatvoxug-eateas.exe ipkeroos-aced.exe File opened for modification C:\Windows\SysWOW64\ifkuxix.exe ipkeroos-aced.exe File created C:\Windows\SysWOW64\ifkuxix.exe ipkeroos-aced.exe File opened for modification C:\Windows\SysWOW64\exmuxod.dll ipkeroos-aced.exe File created C:\Windows\SysWOW64\ipkeroos-aced.exe 4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe File created C:\Windows\SysWOW64\eatvoxug-eateas.exe ipkeroos-aced.exe File created C:\Windows\SysWOW64\exmuxod.dll ipkeroos-aced.exe File opened for modification C:\Windows\SysWOW64\ipkeroos-aced.exe ipkeroos-aced.exe File opened for modification C:\Windows\SysWOW64\ipkeroos-aced.exe 4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 2820 ipkeroos-aced.exe 2820 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe 3728 ipkeroos-aced.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1328 4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe Token: SeDebugPrivilege 3728 ipkeroos-aced.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 3728 1328 4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe 82 PID 1328 wrote to memory of 3728 1328 4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe 82 PID 1328 wrote to memory of 3728 1328 4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe 82 PID 3728 wrote to memory of 616 3728 ipkeroos-aced.exe 5 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 2820 3728 ipkeroos-aced.exe 83 PID 3728 wrote to memory of 2820 3728 ipkeroos-aced.exe 83 PID 3728 wrote to memory of 2820 3728 ipkeroos-aced.exe 83 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56 PID 3728 wrote to memory of 3424 3728 ipkeroos-aced.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe"C:\Users\Admin\AppData\Local\Temp\4df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\ipkeroos-aced.exe"C:\Windows\system32\ipkeroos-aced.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\ipkeroos-aced.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2820
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5b042cbc9bf449ba5f8c7c9dfd3d551af
SHA12567d040adf5d4e60c230c6d8742d9211ac5b536
SHA25647bec4cbc0d6c9a731e3b5ab699b4076a6701202b036ff3f07fc80e7e2bad9c4
SHA512a103449d0bd2e7846f696e30eaf137b8219b31f4f8b9d34164d8b267372afbe3421d671e4517ab7a1c5ec0911770dadcf6a1449b92cebbeb58f6966e2cac2911
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD587791b3c773990ed454e3da2ece2ec9d
SHA165da06d6fd5f2017937d68e679eb1831efae4f43
SHA256f2fb05bb8ec110b900dea90cc325ef2d4a22d4c4939e5c9ecf523b8788a8fe30
SHA51228d2dd903e5530c4d8b55e703700755123cf809aae7a2d7b67cdbe0ad79bc2dfffadab977afab6b810d2660f33a159551e2acf89158c4f0de17a0b677403fbbc
-
Filesize
71KB
MD54a975afe225dcf7571d1a96200d9d77e
SHA1c4fcd60fe5bc1ada4a32a329790e2ffc280b1e7c
SHA2564df3a1ac112c6b88c3fef0b967cbb4fb5c86eb1828489f762ffc86f4a76d9578
SHA5128cbe0aceed0beefabfadb2f8c072504373a70b87823b39f4c4a085fece7b2488e99be92707c5ee8dce4da7a1445e847ced999ee953fba78d562d0d113a36e3d5