2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

General

Target

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
Size

378KB
MD5

002dccebb515daedd0dcf2e423eead5e
SHA1

f4246de95b2e6f3989be1fba0ed1bb079a809ad7
SHA256

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c
SHA512

cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

winyewm.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winyewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winyewm.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winyewm.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winyewm.exe

Executes dropped EXE 1 IoCs

Processes:

winyewm.exe

pid process

2504 winyewm.exe

pid	process
2504	winyewm.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winyewm.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winyewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winyewm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\8486227214447239\\winyewm.exe"	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\8486227214447239\\winyewm.exe"	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

Drops file in Windows directory 3 IoCs

Processes:

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

description	ioc	process
File opened for modification	C:\Windows\8486227214447239	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
File created	C:\Windows\8486227214447239\winyewm.exe	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
File opened for modification	C:\Windows\8486227214447239\winyewm.exe	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2060 3140 WerFault.exe 2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

pid	pid_target	process	target process
2060	3140	WerFault.exe	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exewinyewm.exe

pid	process
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe
2504	winyewm.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe

description	pid	process	target process
PID 3140 wrote to memory of 2504	3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	winyewm.exe
PID 3140 wrote to memory of 2504	3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	winyewm.exe
PID 3140 wrote to memory of 2504	3140	2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe	winyewm.exe

C:\Users\Admin\AppData\Local\Temp\2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe
"C:\Users\Admin\AppData\Local\Temp\2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\8486227214447239\winyewm.exe
  C:\Windows\8486227214447239\winyewm.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 552
  2⤵
  - Program crash
  PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3140 -ip 3140
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\8486227214447239\winyewm.exe

Filesize
378KB

MD5
002dccebb515daedd0dcf2e423eead5e

SHA1
f4246de95b2e6f3989be1fba0ed1bb079a809ad7

SHA256
2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

SHA512
cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Download Submit
C:\Windows\8486227214447239\winyewm.exe

Filesize
378KB

MD5
002dccebb515daedd0dcf2e423eead5e

SHA1
f4246de95b2e6f3989be1fba0ed1bb079a809ad7

SHA256
2732aa8029af8c346964765afc897b8786933b9bebd41c0fcca325a8c7ad608c

SHA512
cc57a70b2c9e28979abcac6ba26bde4c2ffeacdf06a370e8544e557bff58e2324f87fea1b51a3bc8c23a3172282056180b4db0ea613b0906a26e667480a535ff

Download Submit
memory/2504-133-0x0000000000000000-mapping.dmp

Download
memory/2504-136-0x0000000000A13000-0x0000000000A18000-memory.dmp

Filesize
20KB

Download
memory/2504-137-0x0000000000A13000-0x0000000000A18000-memory.dmp

Filesize
20KB

Download
memory/2504-138-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download
memory/2504-140-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download
memory/3140-130-0x0000000000B23000-0x0000000000B28000-memory.dmp

Filesize
20KB

Download
memory/3140-131-0x0000000000B23000-0x0000000000B28000-memory.dmp

Filesize
20KB

Download
memory/3140-132-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download
memory/3140-139-0x0000000000400000-0x000000000093C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads