70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311

General

Target

70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe
Size

396KB
MD5

0e37d61cb00090802c0ca6ea6b0aa3ff
SHA1

f00a0626db912ded090c039fcdb3f9c02bcd9b4c
SHA256

70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311
SHA512

73e47993b53951f0e2d038a69374f7bf777ed1facdef57f6dc65b739505e8bbd54f03dccaea83f9e1b6b9a6e47af97fef735772d0888dbc3b0645d949f478e59
SSDEEP

12288:mb7XWw1Ufy62/sz5U/4wQ0463kbSJwZT2:2TWw12usf0dUbMqS

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CE10CB4EB2331.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe

Disables taskbar notifications via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1340 F4D55F6500014973000CE10CB4EB2331.exe
Deletes itself 1 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1340 F4D55F6500014973000CE10CB4EB2331.exe
Loads dropped DLL 1 IoCs

Processes:

70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe

pid process

1776 70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe

pid	process
1340	F4D55F6500014973000CE10CB4EB2331.exe

pid	process
1340	F4D55F6500014973000CE10CB4EB2331.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CE10CB4EB2331.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CE10CB4EB2331.exe

Modifies registry class 22 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\open\command	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\open	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\.exe	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\runas	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\.exe\ = "F4D55"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\ = "Application"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\Content Type = "application/x-msdownload"	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\start	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\runas\command	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\%s	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\%s\ = "F4D55"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\DefaultIcon	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\DefaultIcon\ = "%1"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell	F4D55F6500014973000CE10CB4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000CE10CB4EB2331\\F4D55F6500014973000CE10CB4EB2331.exe\" -s \"%1\" %*"	F4D55F6500014973000CE10CB4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000_CLASSES\F4D55\shell\start\command	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exeF4D55F6500014973000CE10CB4EB2331.exe

pid	process
1776	70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1340 F4D55F6500014973000CE10CB4EB2331.exe
1340 F4D55F6500014973000CE10CB4EB2331.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1340 F4D55F6500014973000CE10CB4EB2331.exe
1340 F4D55F6500014973000CE10CB4EB2331.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

pid process

1340 F4D55F6500014973000CE10CB4EB2331.exe
1340 F4D55F6500014973000CE10CB4EB2331.exe

pid	process
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe

pid	process
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe

pid	process
1340	F4D55F6500014973000CE10CB4EB2331.exe
1340	F4D55F6500014973000CE10CB4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe

description	pid	process	target process
PID 1776 wrote to memory of 1340	1776	70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe	F4D55F6500014973000CE10CB4EB2331.exe
PID 1776 wrote to memory of 1340	1776	70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe	F4D55F6500014973000CE10CB4EB2331.exe
PID 1776 wrote to memory of 1340	1776	70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe	F4D55F6500014973000CE10CB4EB2331.exe
PID 1776 wrote to memory of 1340	1776	70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe	F4D55F6500014973000CE10CB4EB2331.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

F4D55F6500014973000CE10CB4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CE10CB4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe
"C:\Users\Admin\AppData\Local\Temp\70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776

C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe
"C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311.exe"
2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
0e37d61cb00090802c0ca6ea6b0aa3ff

SHA1
f00a0626db912ded090c039fcdb3f9c02bcd9b4c

SHA256
70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311

SHA512
73e47993b53951f0e2d038a69374f7bf777ed1facdef57f6dc65b739505e8bbd54f03dccaea83f9e1b6b9a6e47af97fef735772d0888dbc3b0645d949f478e59

Download Submit
C:\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
0e37d61cb00090802c0ca6ea6b0aa3ff

SHA1
f00a0626db912ded090c039fcdb3f9c02bcd9b4c

SHA256
70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311

SHA512
73e47993b53951f0e2d038a69374f7bf777ed1facdef57f6dc65b739505e8bbd54f03dccaea83f9e1b6b9a6e47af97fef735772d0888dbc3b0645d949f478e59

Download Submit
\ProgramData\F4D55F6500014973000CE10CB4EB2331\F4D55F6500014973000CE10CB4EB2331.exe

Filesize
396KB

MD5
0e37d61cb00090802c0ca6ea6b0aa3ff

SHA1
f00a0626db912ded090c039fcdb3f9c02bcd9b4c

SHA256
70c2901a5bef377814da9f93e03c8ba689462273f3ec6a5cf63b8dab31242311

SHA512
73e47993b53951f0e2d038a69374f7bf777ed1facdef57f6dc65b739505e8bbd54f03dccaea83f9e1b6b9a6e47af97fef735772d0888dbc3b0645d949f478e59

Download Submit
memory/1340-58-0x0000000000000000-mapping.dmp

Download
memory/1340-63-0x0000000000D30000-0x0000000000E03000-memory.dmp

Filesize
844KB

Download
memory/1776-54-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download
memory/1776-55-0x0000000000190000-0x00000000001E8000-memory.dmp

Filesize
352KB

Download
memory/1776-56-0x00000000003B0000-0x0000000000404000-memory.dmp

Filesize
336KB

Download
memory/1776-62-0x0000000000C40000-0x0000000000D13000-memory.dmp

Filesize
844KB

Download
memory/1776-64-0x0000000000C40000-0x0000000000D13000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads