1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f

General

Target

1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe
Size

357KB
MD5

07b15a8fcde01b11e2028500c8418655
SHA1

816ed9d22a0ef5900cfa1d327d5f0e1e6d53c1a3
SHA256

1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f
SHA512

606df3dceaf57b4406774a9da7de4b57fcb1c04af7ce8dc46e52bf3f991014fbee4aea9748378a905059b1b5d2b82ff692d8c465d12a6c1b5f540dfa44afce38
SSDEEP

6144:oDm1m9nFK7Ax+LYBrtSRbIqz+WSrLGj+wvjG+qhloMHDjFNqz:oDPMAxQ1bH8azq0SFNqz

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CAE15B4EB2331.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CAE15B4EB2331.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

pid process

1792 F4D55F6500014973000CAE15B4EB2331.exe
Deletes itself 1 IoCs

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

pid process

1792 F4D55F6500014973000CAE15B4EB2331.exe

pid	process
1792	F4D55F6500014973000CAE15B4EB2331.exe

pid	process
1792	F4D55F6500014973000CAE15B4EB2331.exe

Loads dropped DLL 2 IoCs

Processes:

1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe

pid	process
1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe
1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CAE15B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CAE15B4EB2331.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CAE15B4EB2331.exe

Modifies registry class 22 IoCs

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\.exe	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\start\command	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\runas	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\%s\ = "F4D55"	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\start	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000CAE15B4EB2331\\F4D55F6500014973000CAE15B4EB2331.exe\" -s \"%1\" %*"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\%s	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\DefaultIcon\ = "%1"	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\open\command	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\open	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*"	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\runas\command	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\.exe\ = "F4D55"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\ = "Application"	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\Content Type = "application/x-msdownload"	F4D55F6500014973000CAE15B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\DefaultIcon	F4D55F6500014973000CAE15B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CAE15B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exeF4D55F6500014973000CAE15B4EB2331.exe

pid	process
1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

pid process

1792 F4D55F6500014973000CAE15B4EB2331.exe
1792 F4D55F6500014973000CAE15B4EB2331.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

pid process

1792 F4D55F6500014973000CAE15B4EB2331.exe
1792 F4D55F6500014973000CAE15B4EB2331.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

pid process

1792 F4D55F6500014973000CAE15B4EB2331.exe
1792 F4D55F6500014973000CAE15B4EB2331.exe

pid	process
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe

pid	process
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe

pid	process
1792	F4D55F6500014973000CAE15B4EB2331.exe
1792	F4D55F6500014973000CAE15B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe

description	pid	process	target process
PID 1160 wrote to memory of 1792	1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe	F4D55F6500014973000CAE15B4EB2331.exe
PID 1160 wrote to memory of 1792	1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe	F4D55F6500014973000CAE15B4EB2331.exe
PID 1160 wrote to memory of 1792	1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe	F4D55F6500014973000CAE15B4EB2331.exe
PID 1160 wrote to memory of 1792	1160	1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe	F4D55F6500014973000CAE15B4EB2331.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

F4D55F6500014973000CAE15B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CAE15B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe
"C:\Users\Admin\AppData\Local\Temp\1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1160

C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe
"C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f.exe"
2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe

Filesize
357KB

MD5
07b15a8fcde01b11e2028500c8418655

SHA1
816ed9d22a0ef5900cfa1d327d5f0e1e6d53c1a3

SHA256
1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f

SHA512
606df3dceaf57b4406774a9da7de4b57fcb1c04af7ce8dc46e52bf3f991014fbee4aea9748378a905059b1b5d2b82ff692d8c465d12a6c1b5f540dfa44afce38

Download Submit
C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe

Filesize
357KB

MD5
07b15a8fcde01b11e2028500c8418655

SHA1
816ed9d22a0ef5900cfa1d327d5f0e1e6d53c1a3

SHA256
1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f

SHA512
606df3dceaf57b4406774a9da7de4b57fcb1c04af7ce8dc46e52bf3f991014fbee4aea9748378a905059b1b5d2b82ff692d8c465d12a6c1b5f540dfa44afce38

Download Submit
\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe

Filesize
357KB

MD5
07b15a8fcde01b11e2028500c8418655

SHA1
816ed9d22a0ef5900cfa1d327d5f0e1e6d53c1a3

SHA256
1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f

SHA512
606df3dceaf57b4406774a9da7de4b57fcb1c04af7ce8dc46e52bf3f991014fbee4aea9748378a905059b1b5d2b82ff692d8c465d12a6c1b5f540dfa44afce38

Download Submit
\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe

Filesize
357KB

MD5
07b15a8fcde01b11e2028500c8418655

SHA1
816ed9d22a0ef5900cfa1d327d5f0e1e6d53c1a3

SHA256
1b1026587a04d74d8fbcabf9521b43448d94cc72f6453fca0827272629aba81f

SHA512
606df3dceaf57b4406774a9da7de4b57fcb1c04af7ce8dc46e52bf3f991014fbee4aea9748378a905059b1b5d2b82ff692d8c465d12a6c1b5f540dfa44afce38

Download Submit
memory/1160-54-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1160-56-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1160-57-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1160-67-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1160-69-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1792-60-0x0000000000000000-mapping.dmp

Download
memory/1792-68-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads