360ebe26e7cf1bbf882275103e6e027251ab2d3b982db697e58bd67957bf2c72

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe
Size

3.2MB
MD5

d9ac308e0ced4578b2d29b6de441f124
SHA1

d57a945fbd7e19c1bb2d42c5bb1e625fbb6cbe00
SHA256

360ebe26e7cf1bbf882275103e6e027251ab2d3b982db697e58bd67957bf2c72
SHA512

ed6a7d27b955d3f15196e5de7534c0e40ad1e93c8472ea97981e8e8b0b5904e5826ea88b0866a818ce81dedca432e3310328bc337d85369cb5bd0ba4abbe8be0
SSDEEP

49152:18yJAk206NICMq5pzKRgqVzKndgFBRwPmtaeNTr:aBskw

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord = "C:\\Users\\Admin\\2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe"	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35

Runs regedit.exe 1 IoCs

pid	Process
2736	regedit.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2864	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	29
PID 1724 wrote to memory of 2864	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	29
PID 1724 wrote to memory of 2864	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	29
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2736	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	31
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2696	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	32
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2668	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	33
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2520	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	34
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35
PID 1724 wrote to memory of 2764	1724	2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe	35

C:\Users\Admin\AppData\Local\Temp\2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_d9ac308e0ced4578b2d29b6de441f124_megazord.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:2668
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2520
- C:\Program Files (x86)\Windows Mail\wab.exe
  "C:\Program Files (x86)\Windows Mail\wab.exe"
  2⤵
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-14-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2864-4-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

Filesize
4KB

Download
memory/2864-7-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2864-8-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2864-9-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2864-6-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2864-10-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2864-5-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2864-12-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2864-13-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download