9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5

General

Target

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Size

1.9MB
MD5

51fbd9736548de79bdbbece7db6ed4ab
SHA1

2f2c1933a2bd9939eddeffd6615c6ffcb10803c1
SHA256

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5
SHA512

2f154955e01b8c04dcb07d9728fbdd169d2fee695d98e57a9a95b6e44e305897fc95eae19c121b9a23bdb06598ae9bb4df76496357d29e0238d5e976ddb9ebf4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe\""	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe = "0"	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe = "0"	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

Drops startup file 2 IoCs

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe = "0"	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe = "0"	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe"	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe"	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4700	powershell.exe
4860	powershell.exe
2600	powershell.exe
2144	powershell.exe
4860	powershell.exe
4700	powershell.exe
2144	powershell.exe
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe

description	pid	process	target process
PID 2640 wrote to memory of 2600	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 2600	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 2600	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 4860	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 4860	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 4860	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 4700	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 4700	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 4700	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 2144	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 2144	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe
PID 2640 wrote to memory of 2144	2640	9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe
"C:\Users\Admin\AppData\Local\Temp\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe"
1⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9499b0710260447af9975b01db876704513975a9a97c119bf004cc4d497ae0b5.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Web Service

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
32a8e7377eb98ddc625db6b8e1bd92d8

SHA1
4808dc42433273e599aa54b2860eba913722fa58

SHA256
d5699a0ee635bb4afc40931e461212fc66858607f4abdf02018e3c5a74aa925f

SHA512
581f92fd819d07cff3ed72521a89adacbbf147cf1bdb8037bb858aa7d8f650dec48ce8a4485c9635e5ab33b9b2bd5b94727280c2ea5558098e1395a0b40513c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
e6ecddc970dfd6d67b308677d804f974

SHA1
d4bdba171a1492160adbcdd9989eab2eac5fca90

SHA256
467718ca7ecaca76181f71ec2fa0ff89e9377a92e3605148a634c24a78f6b2b0

SHA512
52fe31359269ab01c9f1e3d6a352a1547242ae6e20f7beb0fc1d7a30fa0233af231b4286f8368326b0696d03d61d7246d860d1a3e6a7420c321e6ed696b2ef67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
740f205325e5e909e66e697ff50f476f

SHA1
99e888b9e40640d9f470e9b7babd743635c0e822

SHA256
92cf01336a4eb98fb593eb6acd707923e87e8f5568540c5af92b532e85b55e61

SHA512
94a0b26e66e72e39931ac5a8280ae42bdc916630c60cf75608d8112d6379a940ff670d27cda4655aee0f7e322252c72d978a2dd0da3b91dc7de2aabba492e07e

Download Submit
memory/2144-138-0x0000000000000000-mapping.dmp

Download
memory/2144-157-0x0000000007540000-0x0000000007548000-memory.dmp

Filesize
32KB

Download
memory/2144-148-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

Filesize
304KB

Download
memory/2144-142-0x0000000005720000-0x0000000005786000-memory.dmp

Filesize
408KB

Download
memory/2600-154-0x0000000007C40000-0x0000000007CD6000-memory.dmp

Filesize
600KB

Download
memory/2600-149-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

Filesize
304KB

Download
memory/2600-135-0x0000000000000000-mapping.dmp

Download
memory/2600-153-0x0000000007A40000-0x0000000007A4A000-memory.dmp

Filesize
40KB

Download
memory/2600-143-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Filesize
408KB

Download
memory/2600-151-0x00000000079C0000-0x00000000079DA000-memory.dmp

Filesize
104KB

Download
memory/2600-144-0x0000000005450000-0x000000000546E000-memory.dmp

Filesize
120KB

Download
memory/2640-130-0x0000000000480000-0x0000000000664000-memory.dmp

Filesize
1.9MB

Download
memory/2640-134-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/2640-131-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/2640-132-0x0000000005030000-0x00000000050CC000-memory.dmp

Filesize
624KB

Download
memory/2640-133-0x00000000050D0000-0x0000000005162000-memory.dmp

Filesize
584KB

Download
memory/4700-139-0x0000000002270000-0x00000000022A6000-memory.dmp

Filesize
216KB

Download
memory/4700-137-0x0000000000000000-mapping.dmp

Download
memory/4700-152-0x00000000074F0000-0x0000000007B6A000-memory.dmp

Filesize
6.5MB

Download
memory/4700-141-0x0000000004AC0000-0x0000000004AE2000-memory.dmp

Filesize
136KB

Download
memory/4700-147-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

Filesize
304KB

Download
memory/4700-155-0x0000000000610000-0x000000000061E000-memory.dmp

Filesize
56KB

Download
memory/4700-156-0x00000000070C0000-0x00000000070DA000-memory.dmp

Filesize
104KB

Download
memory/4700-140-0x0000000004E10000-0x0000000005438000-memory.dmp

Filesize
6.2MB

Download
memory/4700-145-0x0000000006160000-0x0000000006192000-memory.dmp

Filesize
200KB

Download
memory/4860-150-0x0000000006CE0000-0x0000000006CFE000-memory.dmp

Filesize
120KB

Download
memory/4860-136-0x0000000000000000-mapping.dmp

Download
memory/4860-146-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads