Resubmissions
16-08-2024 07:38
240816-jgl24asfrc 10Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-08-2024 07:38
Behavioral task
behavioral1
Sample
2080afbfc15875a28fb023e5e9b79d50N.exe
Resource
win7-20240704-en
General
-
Target
2080afbfc15875a28fb023e5e9b79d50N.exe
-
Size
870KB
-
MD5
2080afbfc15875a28fb023e5e9b79d50
-
SHA1
74563a45da5b7208a0dffe8a9e083ea580b977fd
-
SHA256
d28c7924207265696e0f26eff973ee0d62a7d1e5f1ef40cd2b8370229f82c531
-
SHA512
9e70441f746cb77eb3dfb6d004f09bf2339408bc8b2f22003bed4ac6d90ae46e18748a9c9f677ce73e6f4a981bc7537defbc2c8ea626a48ea199230f7f620409
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8Glwmk:zQ5aILMCfmAUjzX6xQGCZLFdGm13Jwmk
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0008000000015d39-20.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2544-15-0x00000000003D0000-0x00000000003F9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 1044 2090afbfc16986a29fb023e6e9b89d60N.exe -
Loads dropped DLL 2 IoCs
pid Process 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 2544 2080afbfc15875a28fb023e5e9b79d50N.exe -
pid Process 2880 powershell.exe 2180 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 812 sc.exe 3056 sc.exe 1708 sc.exe 2672 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2080afbfc15875a28fb023e5e9b79d50N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2090afbfc16986a29fb023e6e9b89d60N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2090afbfc16986a29fb023e6e9b89d60N.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 2180 powershell.exe 2880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeTcbPrivilege 1044 2090afbfc16986a29fb023e6e9b89d60N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 1044 2090afbfc16986a29fb023e6e9b89d60N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 3068 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 30 PID 2544 wrote to memory of 3068 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 30 PID 2544 wrote to memory of 3068 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 30 PID 2544 wrote to memory of 3068 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 30 PID 2544 wrote to memory of 2692 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 31 PID 2544 wrote to memory of 2692 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 31 PID 2544 wrote to memory of 2692 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 31 PID 2544 wrote to memory of 2692 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 31 PID 2544 wrote to memory of 2248 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 32 PID 2544 wrote to memory of 2248 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 32 PID 2544 wrote to memory of 2248 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 32 PID 2544 wrote to memory of 2248 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 32 PID 2544 wrote to memory of 2240 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 35 PID 2544 wrote to memory of 2240 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 35 PID 2544 wrote to memory of 2240 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 35 PID 2544 wrote to memory of 2240 2544 2080afbfc15875a28fb023e5e9b79d50N.exe 35 PID 2240 wrote to memory of 2780 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 37 PID 2240 wrote to memory of 2780 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 37 PID 2240 wrote to memory of 2780 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 37 PID 2240 wrote to memory of 2780 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 37 PID 2240 wrote to memory of 2628 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 38 PID 2240 wrote to memory of 2628 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 38 PID 2240 wrote to memory of 2628 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 38 PID 2240 wrote to memory of 2628 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 38 PID 2240 wrote to memory of 2120 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 39 PID 2240 wrote to memory of 2120 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 39 PID 2240 wrote to memory of 2120 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 39 PID 2240 wrote to memory of 2120 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 39 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2240 wrote to memory of 2648 2240 2090afbfc16986a29fb023e6e9b89d60N.exe 40 PID 2692 wrote to memory of 2672 2692 cmd.exe 43 PID 2692 wrote to memory of 2672 2692 cmd.exe 43 PID 2692 wrote to memory of 2672 2692 cmd.exe 43 PID 2692 wrote to memory of 2672 2692 cmd.exe 43 PID 3068 wrote to memory of 1708 3068 cmd.exe 44 PID 3068 wrote to memory of 1708 3068 cmd.exe 44 PID 3068 wrote to memory of 1708 3068 cmd.exe 44 PID 3068 wrote to memory of 1708 3068 cmd.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2080afbfc15875a28fb023e5e9b79d50N.exe"C:\Users\Admin\AppData\Local\Temp\2080afbfc15875a28fb023e5e9b79d50N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\2090afbfc16986a29fb023e6e9b89d60N.exeC:\Users\Admin\AppData\Roaming\WinSocket\2090afbfc16986a29fb023e6e9b89d60N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:812
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3056
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2648
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1AE0B23E-7655-4111-8C93-A8B1F4996003} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1688
-
C:\Users\Admin\AppData\Roaming\WinSocket\2090afbfc16986a29fb023e6e9b89d60N.exeC:\Users\Admin\AppData\Roaming\WinSocket\2090afbfc16986a29fb023e6e9b89d60N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5dc18bc0b4aed9ba34c2444a56705eb5a
SHA16930497be9d39380d95c9e20177e0cabe68975ee
SHA2562cfee8907ba1aa1362735d8283242e1401bb285b7c61f0998b908128a2413369
SHA512bd81944567c2ca7788b66f743ada4260c649c7b2b8721bea5ad8de94a50a37cb3fa88f6cf4e94ee8c5208605b8421169c26ed1d0d880700175a666bd9157f31b
-
Filesize
870KB
MD52080afbfc15875a28fb023e5e9b79d50
SHA174563a45da5b7208a0dffe8a9e083ea580b977fd
SHA256d28c7924207265696e0f26eff973ee0d62a7d1e5f1ef40cd2b8370229f82c531
SHA5129e70441f746cb77eb3dfb6d004f09bf2339408bc8b2f22003bed4ac6d90ae46e18748a9c9f677ce73e6f4a981bc7537defbc2c8ea626a48ea199230f7f620409