8b18494bdf31570cf38d064ef9ef1cf8ae761627cf1b40d793074061653bd6e1

Analysis

max time kernel
3s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Not_Protect.exe
Size 1.5MB
Sample240604-b4le3shf69
SHA256 8b18494bdf31570cf38d064ef9ef1cf8ae761627cf1b40d793074061653bd6e1
MD5 0c855035327347a6fe86f4d3072f2857
SHA1 866595e4ad1056849594c292d871dda20737a526
SHA512 5fad2b81771713664a1e1fb32da64b1f370407a75f7e4640d337874a25bc5795135b09f1b98e3399da370bd8085b644c01ebe694ea12edda5aaf5e5d8dbeed9d
SSDEEP 49152:OfQopNW5zJvG4nuzMUV5MTSV7fjP6FmOj6:asvkV5MuV7fjP6Ftj6
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1448	sc.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2828	timeout.exe

Kills process with taskkill 16 IoCs

evasion

pid	Process
1772	taskkill.exe
2724	taskkill.exe
2852	taskkill.exe
1276	taskkill.exe
1100	taskkill.exe
2352	taskkill.exe
1704	taskkill.exe
880	taskkill.exe
1424	taskkill.exe
2572	taskkill.exe
2548	taskkill.exe
1556	taskkill.exe
1908	taskkill.exe
2124	taskkill.exe
1344	taskkill.exe
2212	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe
1536	Not_Protect.exe

C:\Users\Admin\AppData\Local\Temp\Not_Protect.exe
"C:\Users\Admin\AppData\Local\Temp\Not_Protect.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc stop vgk
  2⤵
  PID:2584
- - C:\Windows\system32\sc.exe
    sc stop vgk
    3⤵
    - Launches sc.exe
    PID:1448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /f /im mmc.exe >nul 2>&1
  2⤵
  PID:2596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Kills process with taskkill
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Not_Protect.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:2372
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Not_Protect.exe" MD5
    3⤵
    PID:1112
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1740
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:2404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /f /im processhacker.exe >nul 2>&1
  2⤵
  PID:1476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2332
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2324
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq taskmanager*" /IM * /F /T >nul 2>&1
  2⤵
  PID:800
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq taskmanager*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq taskmgr*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1796
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq taskmgr*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1900
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /f /im mmc.exe >nul 2>&1
  2⤵
  PID:2388
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mmc.exe
    3⤵
    - Kills process with taskkill
    PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:2408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /f /im processhacker.exe >nul 2>&1
  2⤵
  PID:2716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1572
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1620
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq taskmanager*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1640
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq taskmanager*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
  2⤵
  PID:1780
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
    3⤵
    PID:2080
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq taskmgr*" /IM * /F /T >nul 2>&1
  2⤵
  PID:612
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq taskmgr*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2244
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-2-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-1-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-0-0x0000000077550000-0x0000000077551000-memory.dmp

Download

memory/1536-3-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-4-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-5-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-10-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-8-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-7-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-11-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-6-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-12-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-9-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-13-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-14-0x0000000077500000-0x00000000776A9000-memory.dmp

Download

memory/1536-15-0x0000000077500000-0x00000000776A9000-memory.dmp

Download