2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

General

Target

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
Size

378KB
MD5

002dccebb515daedd0dcf2e423eead5e
SHA1

f4246de95b2e6f3989be1fba0ed1bb079a809ad7
SHA256

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c
SHA512

cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winuqqi.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winuqqi.exe

Executes dropped EXE 1 IoCs

pid	Process
2024	winuqqi.exe

Loads dropped DLL 2 IoCs

pid	Process
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winuqqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winuqqi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\7218238714452134\\winuqqi.exe"	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\7218238714452134\\winuqqi.exe"	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\7218238714452134\winuqqi.exe	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
File opened for modification	C:\Windows\7218238714452134\winuqqi.exe	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
File opened for modification	C:\Windows\7218238714452134	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe
2024	winuqqi.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2024	1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	28
PID 1956 wrote to memory of 2024	1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	28
PID 1956 wrote to memory of 2024	1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	28
PID 1956 wrote to memory of 2024	1956	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	28

C:\Users\Admin\AppData\Local\Temp\2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
"C:\Users\Admin\AppData\Local\Temp\2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\7218238714452134\winuqqi.exe
  C:\Windows\7218238714452134\winuqqi.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\7218238714452134\winuqqi.exe

Filesize
378KB

MD5
002dccebb515daedd0dcf2e423eead5e

SHA1
f4246de95b2e6f3989be1fba0ed1bb079a809ad7

SHA256
2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

SHA512
cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Download Submit
C:\Windows\7218238714452134\winuqqi.exe

Filesize
378KB

MD5
002dccebb515daedd0dcf2e423eead5e

SHA1
f4246de95b2e6f3989be1fba0ed1bb079a809ad7

SHA256
2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

SHA512
cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Download Submit
\Windows\7218238714452134\winuqqi.exe

Filesize
378KB

MD5
002dccebb515daedd0dcf2e423eead5e

SHA1
f4246de95b2e6f3989be1fba0ed1bb079a809ad7

SHA256
2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

SHA512
cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Download Submit
\Windows\7218238714452134\winuqqi.exe

Filesize
378KB

MD5
002dccebb515daedd0dcf2e423eead5e

SHA1
f4246de95b2e6f3989be1fba0ed1bb079a809ad7

SHA256
2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

SHA512
cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Download Submit
memory/1956-57-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download
memory/1956-54-0x0000000000A75000-0x0000000000A7A000-memory.dmp

Filesize
20KB

Download
memory/1956-56-0x0000000000A75000-0x0000000000A7A000-memory.dmp

Filesize
20KB

Download
memory/1956-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/2024-62-0x0000000000DC5000-0x0000000000DCA000-memory.dmp

Filesize
20KB

Download
memory/2024-64-0x0000000000DC5000-0x0000000000DCA000-memory.dmp

Filesize
20KB

Download
memory/2024-65-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download
memory/2024-67-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads