2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267

General

Target

2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
Size

385KB
MD5

87844ce0e37030e3575872ba6b4c8ebe
SHA1

747651876b3a6b2824b41932676da1dd3b932044
SHA256

2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267
SHA512

7c8fa47208d8a1bcb342adfe1aa5e20559f2098bad90e2cd7d23b5120ea4437e5a75306d104de2932cc04ee22031cf1f9dd873c3cbb360872fa1cb3c7c77fde6

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	windyun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	windyun.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	windyun.exe

Executes dropped EXE 1 IoCs

pid	Process
1364	windyun.exe

Loads dropped DLL 2 IoCs

pid	Process
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	windyun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	windyun.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\7609715718281226\\windyun.exe"	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\7609715718281226\\windyun.exe"	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\7609715718281226\windyun.exe	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
File opened for modification	C:\Windows\7609715718281226\windyun.exe	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
File opened for modification	C:\Windows\7609715718281226	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe
1364	windyun.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1364	1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe	27
PID 1892 wrote to memory of 1364	1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe	27
PID 1892 wrote to memory of 1364	1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe	27
PID 1892 wrote to memory of 1364	1892	2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe	27

C:\Users\Admin\AppData\Local\Temp\2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe
"C:\Users\Admin\AppData\Local\Temp\2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\7609715718281226\windyun.exe
  C:\Windows\7609715718281226\windyun.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\7609715718281226\windyun.exe

Filesize
385KB

MD5
87844ce0e37030e3575872ba6b4c8ebe

SHA1
747651876b3a6b2824b41932676da1dd3b932044

SHA256
2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267

SHA512
7c8fa47208d8a1bcb342adfe1aa5e20559f2098bad90e2cd7d23b5120ea4437e5a75306d104de2932cc04ee22031cf1f9dd873c3cbb360872fa1cb3c7c77fde6

Download Submit
C:\Windows\7609715718281226\windyun.exe

Filesize
385KB

MD5
87844ce0e37030e3575872ba6b4c8ebe

SHA1
747651876b3a6b2824b41932676da1dd3b932044

SHA256
2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267

SHA512
7c8fa47208d8a1bcb342adfe1aa5e20559f2098bad90e2cd7d23b5120ea4437e5a75306d104de2932cc04ee22031cf1f9dd873c3cbb360872fa1cb3c7c77fde6

Download Submit
\Windows\7609715718281226\windyun.exe

Filesize
385KB

MD5
87844ce0e37030e3575872ba6b4c8ebe

SHA1
747651876b3a6b2824b41932676da1dd3b932044

SHA256
2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267

SHA512
7c8fa47208d8a1bcb342adfe1aa5e20559f2098bad90e2cd7d23b5120ea4437e5a75306d104de2932cc04ee22031cf1f9dd873c3cbb360872fa1cb3c7c77fde6

Download Submit
\Windows\7609715718281226\windyun.exe

Filesize
385KB

MD5
87844ce0e37030e3575872ba6b4c8ebe

SHA1
747651876b3a6b2824b41932676da1dd3b932044

SHA256
2aae2375a8cf31575ea9a80bdeddc9ec97586e156e4d0d466d42ffec800ec267

SHA512
7c8fa47208d8a1bcb342adfe1aa5e20559f2098bad90e2cd7d23b5120ea4437e5a75306d104de2932cc04ee22031cf1f9dd873c3cbb360872fa1cb3c7c77fde6

Download Submit
memory/1364-64-0x0000000000B15000-0x0000000000B1A000-memory.dmp

Filesize
20KB

Download
memory/1364-62-0x0000000000B15000-0x0000000000B1A000-memory.dmp

Filesize
20KB

Download
memory/1364-65-0x0000000000400000-0x000000000093E000-memory.dmp

Filesize
5.2MB

Download
memory/1364-67-0x0000000000400000-0x000000000093E000-memory.dmp

Filesize
5.2MB

Download
memory/1892-57-0x0000000000400000-0x000000000093E000-memory.dmp

Filesize
5.2MB

Download
memory/1892-56-0x0000000000DC5000-0x0000000000DCA000-memory.dmp

Filesize
20KB

Download
memory/1892-54-0x0000000000DC5000-0x0000000000DCA000-memory.dmp

Filesize
20KB

Download
memory/1892-55-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads