fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30

General

Target

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Size

396KB
MD5

09f5b069a7ca605e7a8cb54b94a1aa94
SHA1

e7d66c1e4a48a1febf3fb56e7de9f0227de8d025
SHA256

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30
SHA512

1e09924b6860bc1aa95d8e2596ddcb6dddf6470b793569fa0876347cd6334616dbbbce7433974beac9328f3e0fd17fcba837fac77e0761aaa458146f6a22a113
SSDEEP

6144:vbxVBzpbEjLDe4KWFqf9QqJmik3lzW8BYHJmFOyXGDnziFzN4/l0aoV0:1R2xKWFcqwcmJmFbWTzYiNX

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exeF4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1292 F4D55F6500014973000CE10CB4EB2331.exe
Deletes itself 1 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1292 F4D55F6500014973000CE10CB4EB2331.exe

Loads dropped DLL 2 IoCs

Processes:

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe

pid	process
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exeF4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000CE10CB4EB2331 = "C:\\ProgramData\\F4D55F6500014973000CE10CB4EB2331\\F4D55F6500014973000CE10CB4EB2331.exe"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exeF4D55F6500014973000CE10CB4EB2331.exe

pid	process
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid	process
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid	process
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe
1292	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1292 F4D55F6500014973000CE10CB4EB2331.exe
1292 F4D55F6500014973000CE10CB4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe

description	pid	process	target process
PID 1416 wrote to memory of 1292	1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe	F4D55F6500014973000CE10CB4EB2331.exe
PID 1416 wrote to memory of 1292	1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe	F4D55F6500014973000CE10CB4EB2331.exe
PID 1416 wrote to memory of 1292	1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe	F4D55F6500014973000CE10CB4EB2331.exe
PID 1416 wrote to memory of 1292	1416	fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe	F4D55F6500014973000CE10CB4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe
"C:\Users\Admin\AppData\Local\Temp\fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1416

C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe
"C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30.exe"
2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
09f5b069a7ca605e7a8cb54b94a1aa94

SHA1
e7d66c1e4a48a1febf3fb56e7de9f0227de8d025

SHA256
fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30

SHA512
1e09924b6860bc1aa95d8e2596ddcb6dddf6470b793569fa0876347cd6334616dbbbce7433974beac9328f3e0fd17fcba837fac77e0761aaa458146f6a22a113

Download Submit
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
09f5b069a7ca605e7a8cb54b94a1aa94

SHA1
e7d66c1e4a48a1febf3fb56e7de9f0227de8d025

SHA256
fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30

SHA512
1e09924b6860bc1aa95d8e2596ddcb6dddf6470b793569fa0876347cd6334616dbbbce7433974beac9328f3e0fd17fcba837fac77e0761aaa458146f6a22a113

Download Submit
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
09f5b069a7ca605e7a8cb54b94a1aa94

SHA1
e7d66c1e4a48a1febf3fb56e7de9f0227de8d025

SHA256
fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30

SHA512
1e09924b6860bc1aa95d8e2596ddcb6dddf6470b793569fa0876347cd6334616dbbbce7433974beac9328f3e0fd17fcba837fac77e0761aaa458146f6a22a113

Download Submit
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
09f5b069a7ca605e7a8cb54b94a1aa94

SHA1
e7d66c1e4a48a1febf3fb56e7de9f0227de8d025

SHA256
fa9e0831770c2073b9eb4653df9aba52dc24563d2665b52b71d323602b4b8a30

SHA512
1e09924b6860bc1aa95d8e2596ddcb6dddf6470b793569fa0876347cd6334616dbbbce7433974beac9328f3e0fd17fcba837fac77e0761aaa458146f6a22a113

Download Submit
memory/1292-57-0x0000000000000000-mapping.dmp

Download
memory/1292-63-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1292-64-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1416-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1416-61-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/1416-62-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1416-65-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads