4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f

General

Target

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Size

456KB
MD5

348849daef497a3deb57780f1b453ec6
SHA1

a789a9308d5b745278e05344a18a3ff6f2233f90
SHA256

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f
SHA512

c2b4796b517be3fd066520f1279e2963394c16fec746d65f70acb16dc3ab6db4cca0cf362a299e9dbbd1eaba07218b9951e04757c160dffbbbd54ed1c1c75586
SSDEEP

12288:IL5cUB8YBJ8W96FXYHAvb8QSCiuZTccuuE57:c5cUOYjN2oQIQSCxZIcuBN

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exeF4D55F6500014973000B4090B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000B4090B4EB2331.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

F4D55F6500014973000B4090B4EB2331.exe

pid process

1940 F4D55F6500014973000B4090B4EB2331.exe
Deletes itself 1 IoCs

Processes:

F4D55F6500014973000B4090B4EB2331.exe

pid process

1940 F4D55F6500014973000B4090B4EB2331.exe

pid	process
1940	F4D55F6500014973000B4090B4EB2331.exe

pid	process
1940	F4D55F6500014973000B4090B4EB2331.exe

Loads dropped DLL 2 IoCs

Processes:

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe

pid	process
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exeF4D55F6500014973000B4090B4EB2331.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000B4090B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000B4090B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

F4D55F6500014973000B4090B4EB2331.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000B4090B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000B4090B4EB2331\\F4D55F6500014973000B4090B4EB2331.exe"	F4D55F6500014973000B4090B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exeF4D55F6500014973000B4090B4EB2331.exe

pid	process
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

F4D55F6500014973000B4090B4EB2331.exe

pid process

1940 F4D55F6500014973000B4090B4EB2331.exe
1940 F4D55F6500014973000B4090B4EB2331.exe
1940 F4D55F6500014973000B4090B4EB2331.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

F4D55F6500014973000B4090B4EB2331.exe

pid process

1940 F4D55F6500014973000B4090B4EB2331.exe
1940 F4D55F6500014973000B4090B4EB2331.exe
1940 F4D55F6500014973000B4090B4EB2331.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

F4D55F6500014973000B4090B4EB2331.exe

pid process

1940 F4D55F6500014973000B4090B4EB2331.exe
1940 F4D55F6500014973000B4090B4EB2331.exe

pid	process
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe

pid	process
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe

pid	process
1940	F4D55F6500014973000B4090B4EB2331.exe
1940	F4D55F6500014973000B4090B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe

description	pid	process	target process
PID 1664 wrote to memory of 1940	1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe	F4D55F6500014973000B4090B4EB2331.exe
PID 1664 wrote to memory of 1940	1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe	F4D55F6500014973000B4090B4EB2331.exe
PID 1664 wrote to memory of 1940	1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe	F4D55F6500014973000B4090B4EB2331.exe
PID 1664 wrote to memory of 1940	1664	4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe	F4D55F6500014973000B4090B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe
"C:\Users\Admin\AppData\Local\Temp\4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664

C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe
"C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f.exe"
2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe

Filesize
456KB

MD5
348849daef497a3deb57780f1b453ec6

SHA1
a789a9308d5b745278e05344a18a3ff6f2233f90

SHA256
4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f

SHA512
c2b4796b517be3fd066520f1279e2963394c16fec746d65f70acb16dc3ab6db4cca0cf362a299e9dbbd1eaba07218b9951e04757c160dffbbbd54ed1c1c75586

Download Submit
C:\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe

Filesize
456KB

MD5
348849daef497a3deb57780f1b453ec6

SHA1
a789a9308d5b745278e05344a18a3ff6f2233f90

SHA256
4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f

SHA512
c2b4796b517be3fd066520f1279e2963394c16fec746d65f70acb16dc3ab6db4cca0cf362a299e9dbbd1eaba07218b9951e04757c160dffbbbd54ed1c1c75586

Download Submit
\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe

Filesize
456KB

MD5
348849daef497a3deb57780f1b453ec6

SHA1
a789a9308d5b745278e05344a18a3ff6f2233f90

SHA256
4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f

SHA512
c2b4796b517be3fd066520f1279e2963394c16fec746d65f70acb16dc3ab6db4cca0cf362a299e9dbbd1eaba07218b9951e04757c160dffbbbd54ed1c1c75586

Download Submit
\ProgramData\F4D55F6500014973000B4090B4EB2331\F4D55F6500014973000B4090B4EB2331.exe

Filesize
456KB

MD5
348849daef497a3deb57780f1b453ec6

SHA1
a789a9308d5b745278e05344a18a3ff6f2233f90

SHA256
4855b0ee47b0b67e9dd494aa22e5875ef6a49b6b27e0782b9734109cae28e72f

SHA512
c2b4796b517be3fd066520f1279e2963394c16fec746d65f70acb16dc3ab6db4cca0cf362a299e9dbbd1eaba07218b9951e04757c160dffbbbd54ed1c1c75586

Download Submit
memory/1664-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1664-61-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/1664-63-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/1940-57-0x0000000000000000-mapping.dmp

Download
memory/1940-62-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads