1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2

General

Target

1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Size

492KB
MD5

01809d1b522e3c6e36d8123277fc9b50
SHA1

2b52deff76cd727c7725b9c73af41ec52bf4c4c4
SHA256

1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2
SHA512

8f29eca751849ea5b80b7648c2173496580003150d06cd635490f78c6797401f0be44a8ed6d3c1d60e9d5534466e0b0b0933ff6e33027ecefc2a29aa63cf7cb6
SSDEEP

12288:tY5tmk925ydFQQZ4KumF+C2VW+HNAeE5:Q/2gdFQQZtXF+C2VWaN+

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000C4E45B4EB2331.exe1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

F4D55F6500014973000C4E45B4EB2331.exe

pid process

760 F4D55F6500014973000C4E45B4EB2331.exe
Deletes itself 1 IoCs

Processes:

F4D55F6500014973000C4E45B4EB2331.exe

pid process

760 F4D55F6500014973000C4E45B4EB2331.exe

pid	process
760	F4D55F6500014973000C4E45B4EB2331.exe

pid	process
760	F4D55F6500014973000C4E45B4EB2331.exe

Loads dropped DLL 2 IoCs

Processes:

1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe

pid	process
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exeF4D55F6500014973000C4E45B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

F4D55F6500014973000C4E45B4EB2331.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000C4E45B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000C4E45B4EB2331\\F4D55F6500014973000C4E45B4EB2331.exe"	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exeF4D55F6500014973000C4E45B4EB2331.exe

pid	process
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

F4D55F6500014973000C4E45B4EB2331.exe

pid process

760 F4D55F6500014973000C4E45B4EB2331.exe
760 F4D55F6500014973000C4E45B4EB2331.exe
760 F4D55F6500014973000C4E45B4EB2331.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

F4D55F6500014973000C4E45B4EB2331.exe

pid process

760 F4D55F6500014973000C4E45B4EB2331.exe
760 F4D55F6500014973000C4E45B4EB2331.exe
760 F4D55F6500014973000C4E45B4EB2331.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

F4D55F6500014973000C4E45B4EB2331.exe

pid process

760 F4D55F6500014973000C4E45B4EB2331.exe
760 F4D55F6500014973000C4E45B4EB2331.exe

pid	process
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe

pid	process
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe

pid	process
760	F4D55F6500014973000C4E45B4EB2331.exe
760	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe

description	pid	process	target process
PID 560 wrote to memory of 760	560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe	F4D55F6500014973000C4E45B4EB2331.exe
PID 560 wrote to memory of 760	560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe	F4D55F6500014973000C4E45B4EB2331.exe
PID 560 wrote to memory of 760	560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe	F4D55F6500014973000C4E45B4EB2331.exe
PID 560 wrote to memory of 760	560	1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe	F4D55F6500014973000C4E45B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe
"C:\Users\Admin\AppData\Local\Temp\1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560

C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe
"C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2.exe"
2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
492KB

MD5
01809d1b522e3c6e36d8123277fc9b50

SHA1
2b52deff76cd727c7725b9c73af41ec52bf4c4c4

SHA256
1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2

SHA512
8f29eca751849ea5b80b7648c2173496580003150d06cd635490f78c6797401f0be44a8ed6d3c1d60e9d5534466e0b0b0933ff6e33027ecefc2a29aa63cf7cb6

Download Submit
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
492KB

MD5
01809d1b522e3c6e36d8123277fc9b50

SHA1
2b52deff76cd727c7725b9c73af41ec52bf4c4c4

SHA256
1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2

SHA512
8f29eca751849ea5b80b7648c2173496580003150d06cd635490f78c6797401f0be44a8ed6d3c1d60e9d5534466e0b0b0933ff6e33027ecefc2a29aa63cf7cb6

Download Submit
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
492KB

MD5
01809d1b522e3c6e36d8123277fc9b50

SHA1
2b52deff76cd727c7725b9c73af41ec52bf4c4c4

SHA256
1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2

SHA512
8f29eca751849ea5b80b7648c2173496580003150d06cd635490f78c6797401f0be44a8ed6d3c1d60e9d5534466e0b0b0933ff6e33027ecefc2a29aa63cf7cb6

Download Submit
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
492KB

MD5
01809d1b522e3c6e36d8123277fc9b50

SHA1
2b52deff76cd727c7725b9c73af41ec52bf4c4c4

SHA256
1296093de074002fa8ee115432439182f4e8338008aeb02fd5cbb29da0d2cdd2

SHA512
8f29eca751849ea5b80b7648c2173496580003150d06cd635490f78c6797401f0be44a8ed6d3c1d60e9d5534466e0b0b0933ff6e33027ecefc2a29aa63cf7cb6

Download Submit
memory/560-54-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/560-55-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/560-63-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/560-64-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/760-58-0x0000000000000000-mapping.dmp

Download
memory/760-62-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads