Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 19:46
Static task
static1
Behavioral task
behavioral1
Sample
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe
Resource
win10v2004-20240508-en
General
-
Target
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe
-
Size
266KB
-
MD5
4e4023be3e23245fd40b90f1222e9e9e
-
SHA1
43c1fe1ffb8e72019839c1dd65925739c7521b1a
-
SHA256
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce
-
SHA512
4a0701468cd22dd3b090868d0f0350f238dcc0f1e775e70093ae469362603dcb41ab3316c8353977b821672cb33452310548cff15d0fd4344c010906b1933ca4
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/D:WFzDqa86hV6uRRqX1evPlwAr
Malware Config
Signatures
-
Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2508-36-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2508-35-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2508-34-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2508-32-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2508-29-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 2916 HiPatchService.exe -
Loads dropped DLL 1 IoCs
Processes:
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exepid process 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 2916 set thread context of 2508 2916 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegAsm.exepid process 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe 2508 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exeHiPatchService.exedescription pid process target process PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2916 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe HiPatchService.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 1928 wrote to memory of 2628 1928 284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe cmd.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe PID 2916 wrote to memory of 2508 2916 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe"C:\Users\Admin\AppData\Local\Temp\284cd57bdeef12c8d2467d7a817a4a173a5a59f25d4d80b6dcf472279d00f9ce.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2508 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵PID:2628
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
266KB
MD50176ce96f39da728a2dba0ca054180ee
SHA15541bce232241128768faf0377d5789f8a54e5bf
SHA25696913eaedc8ababa70c19925463a872ae28c80e2f3f7c2a0ea56d7063ca1cea5
SHA512f509d8d495ead291d6c5c159f6b5f332e020588f396e23b62736379122553900bd65472865fc4fc7c37be242ce9268aa23e5c22f200d776806b2820a7f07f1d3