Overview

overview

10

Static

static

3

a66e93cf33...ed.exe

windows7-x64

10

a66e93cf33...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 01:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a66e93cf33348a020fd667695b7e315c800571fe840f05cb85f37037b02da3ed.exe
  • Size 234KB
  • Sample240530-bn2gcsab43
  • SHA256 a66e93cf33348a020fd667695b7e315c800571fe840f05cb85f37037b02da3ed
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionexecutiontrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
    evasiontrojan
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Launches sc.exe 16 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a66e93cf33348a020fd667695b7e315c800571fe840f05cb85f37037b02da3ed.exe
    "C:\Users\Admin\AppData\Local\Temp\a66e93cf33348a020fd667695b7e315c800571fe840f05cb85f37037b02da3ed.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Checks computer location settings
    • Windows security modification
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config wdfilter start=disabled
      2⤵
      • Launches sc.exe
      PID:2616
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WerSvc start=disabled
      2⤵
      • Launches sc.exe
      PID:2972
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\system32\sc.exe
        sc stop wdfilter
        3⤵
        • Launches sc.exe
        PID:1020
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WinDefend start=disabled
      2⤵
      • Launches sc.exe
      PID:4216
    • C:\Users\Admin\AppData\Local\Temp\nvufegpc.bat
      "C:\Users\Admin\AppData\Local\Temp\nvufegpc.bat" ok
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Checks computer location settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3692
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" config wdfilter start=disabled
        3⤵
        • Launches sc.exe
        PID:2240
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" config WerSvc start=disabled
        3⤵
        • Launches sc.exe
        PID:4680
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\system32\sc.exe
          sc stop wdfilter
          4⤵
          • Launches sc.exe
          PID:4964
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" config WinDefend start=disabled
        3⤵
        • Launches sc.exe
        PID:540
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop WerSvc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4188
        • C:\Windows\system32\sc.exe
          sc stop WerSvc
          4⤵
          • Launches sc.exe
          PID:868
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" config WdNisSvc start=disabled
        3⤵
        • Launches sc.exe
        PID:452
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:2128
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" config XblGameSave start=disabled
        3⤵
        • Launches sc.exe
        PID:1372
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Windows\system32\sc.exe
          sc stop WdNisSvc
          4⤵
          • Launches sc.exe
          PID:1028
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop XblGameSave
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\system32\sc.exe
          sc stop XblGameSave
          4⤵
          • Launches sc.exe
          PID:3212
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "XXXXX" -AppPathNameMatchCondition "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe" -ThrottleRateActionBitsPerSecond 8
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-NetQosPolicy -Name "YYYYY" -AppPathNameMatchCondition "C:\Program Files (x86)\Common Files\BattlEye\BEService.exe" -ThrottleRateActionBitsPerSecond 8
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop wdfilter
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\system32\sc.exe
          sc stop wdfilter
          4⤵
          • Launches sc.exe
          PID:1824
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop faceit
        3⤵
          PID:2840
          • C:\Windows\system32\sc.exe
            sc stop faceit
            4⤵
            • Launches sc.exe
            PID:2984
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\78f25d85-9070-43ed-88d7-2440e5305124.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\system32\attrib.exe
          attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\a66e93cf33348a020fd667695b7e315c800571fe840f05cb85f37037b02da3ed.exe"
          3⤵
          • Views/modifies file attributes
          PID:900
        • C:\Windows\system32\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d 0 /f
          3⤵
            PID:2836
          • C:\Windows\system32\timeout.exe
            timeout /T 1
            3⤵
            • Delays execution with timeout.exe
            PID:1124
          • C:\Windows\system32\attrib.exe
            attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\a66e93cf33348a020fd667695b7e315c800571fe840f05cb85f37037b02da3ed.exe"
            3⤵
            • Views/modifies file attributes
            PID:632
          • C:\Windows\system32\wevtutil.exe
            wevtutil el
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3864
          • C:\Windows\system32\attrib.exe
            attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\78f25d85-9070-43ed-88d7-2440e5305124.bat"
            3⤵
            • Views/modifies file attributes
            PID:2836

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
            • MD5 SHA1 SHA512
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 948B
            • SHA256 7a54dcc99ebfb850afde560857e2d1f764a53ff09efd03222f56ab547539798f
            • MD5 SHA1 SHA512
            Submit Download

            78f25d85-9070-43ed-88d7-2440e5305124.bat
            • Path C:\Users\Admin\AppData\Local\Temp\78f25d85-9070-43ed-88d7-2440e5305124.bat
            • Size 776B
            • SHA256 07c2028a23409c7be76a523d87cf2f81d7b79c1a998d04403e69bf9fe7bc92f1
            • MD5 SHA1 SHA512
            Submit Download

            __PSScriptPolicyTest_5labz13x.thk.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5labz13x.thk.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            nvufegpc.bat
            • Path C:\Users\Admin\AppData\Local\Temp\nvufegpc.bat
            • Size 235KB
            • SHA256 0781b7c12b34d166e83211872417139f8c083005d51799ad683e9d83b777ea55
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            unknown.log
            • Path C:\Users\Admin\AppData\Roaming\spf\unknown.log
            • Size 271B
            • SHA256 55f4af7f9777fb1b711f8492d67e1766a4e424aa2e181eb159e57234f1297d94
            • MD5 SHA1 SHA512
            Submit Download

            memory/1052-1-0x00007FFB06F83000-0x00007FFB06F85000-memory.dmp
            Download

            memory/1052-0-0x000002A0FAC90000-0x000002A0FACCE000-memory.dmp
            Download

            memory/1052-2-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
            Download

            memory/1052-16-0x00007FFB06F80000-0x00007FFB07A41000-memory.dmp
            Download

            memory/4652-28-0x0000012F1C630000-0x0000012F1C652000-memory.dmp
            Download