68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da

General

Target

68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Size

67KB
MD5

ade8d1af64fafc95075e8f95791960f8
SHA1

c5c25ebce958e2d7d1d681b0f99491a3aa93457f
SHA256

68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da
SHA512

c18054fa285b862b87f89f820fb224e89be5d85988a3e5280022ce552b6b8d2de96d28efd7e141c38456aae36e600b9af296dc83a0a15cfc1708c3f541a0649c

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\winsvcsu.exe"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winsvcsu.exe"	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winsvcsu.exe	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
File opened for modification	C:\Windows\winsvcsu.exe	68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe

C:\Users\Admin\AppData\Local\Temp\68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe
"C:\Users\Admin\AppData\Local\Temp\68ca21ebaec1f7a40e25b348e8275c56b7fede56ea30ec2215c535f63d5f04da.bin.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads