3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc

Analysis

max time kernel
22s
max time network
85s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Size

428KB
MD5

02a2e25e97ecd7e58533736d92ea2fd1
SHA1

a404cc112ffde2417bd0de4fed73cc9df78bf003
SHA256

3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc
SHA512

b4b7b115b78a2e2aaac8c74e3920f1aefa27dcbfb0dbb3f5fbda6352295bd2d94cf884abb442873ec859bf7b6a24410e855d8e63096e15ae2a3a8e06bd30ae73
SSDEEP

12288:GpEDPmpon9PRiHNQDkUm2mGjhinVFofaw61kwwwwb:ZDPmpAPDDkUm2mG9iDX

Score

10^/10

evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
532	3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe

C:\Users\Admin\AppData\Local\Temp\3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe
"C:\Users\Admin\AppData\Local\Temp\3c19b0ab084eb49b989a8824e37b8360420d15344c08d2a0b069edf041ad06cc.exe"
1⤵
- Windows security bypass
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-54-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/532-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/532-57-0x0000000000350000-0x0000000000353000-memory.dmp

Filesize
12KB

Download
memory/532-56-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/532-58-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download