a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08

General

Target

a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Size

646KB
MD5

8fba405998aa281996ace0b5bf72f100
SHA1

d2493023ab0cb67151bcd7db9fff2f06e46840d3
SHA256

a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08
SHA512

67038ef7123827f4a1510475abd5a5b726ef33ca7f84f5418af09c0c3594ee2404e62f301be8bfbb728d2e5500e78dabfb1f8fa52f10ae24b02dff11785a493b

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	powershell.exe
4464	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4464	2588	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe	85
PID 2588 wrote to memory of 4464	2588	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe	85
PID 2588 wrote to memory of 4464	2588	a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe	85

C:\Users\Admin\AppData\Local\Temp\a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe
"C:\Users\Admin\AppData\Local\Temp\a453c72f70300b3ffbafefe87396342061b8b847e68eba4891b51ab1b7edfb08.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-130-0x0000000000C00000-0x0000000000CA8000-memory.dmp

Filesize
672KB

Download
memory/2588-131-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/2588-132-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/2588-133-0x00000000055B0000-0x00000000055BA000-memory.dmp

Filesize
40KB

Download
memory/2588-134-0x000000000A2A0000-0x000000000A33C000-memory.dmp

Filesize
624KB

Download
memory/2588-135-0x00000000013E0000-0x0000000001446000-memory.dmp

Filesize
408KB

Download
memory/4464-137-0x0000000002D40000-0x0000000002D76000-memory.dmp

Filesize
216KB

Download
memory/4464-138-0x0000000005800000-0x0000000005E28000-memory.dmp

Filesize
6.2MB

Download
memory/4464-139-0x0000000005680000-0x00000000056A2000-memory.dmp

Filesize
136KB

Download
memory/4464-140-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Filesize
408KB

Download
memory/4464-141-0x00000000066D0000-0x00000000066EE000-memory.dmp

Filesize
120KB

Download
memory/4464-142-0x0000000001000000-0x0000000001032000-memory.dmp

Filesize
200KB

Download
memory/4464-143-0x000000006FE40000-0x000000006FE8C000-memory.dmp

Filesize
304KB

Download
memory/4464-144-0x0000000000DB0000-0x0000000000DCE000-memory.dmp

Filesize
120KB

Download
memory/4464-145-0x0000000008060000-0x00000000086DA000-memory.dmp

Filesize
6.5MB

Download
memory/4464-146-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/4464-147-0x0000000007A50000-0x0000000007A5A000-memory.dmp

Filesize
40KB

Download
memory/4464-148-0x0000000007C60000-0x0000000007CF6000-memory.dmp

Filesize
600KB

Download
memory/4464-149-0x0000000007C10000-0x0000000007C1E000-memory.dmp

Filesize
56KB

Download
memory/4464-150-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Filesize
104KB

Download
memory/4464-151-0x0000000007D00000-0x0000000007D08000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads