efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c

General

Target

efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe
Size

352KB
MD5

1a9c7e67fee0bd287509a34382d91c59
SHA1

28944e2eb4a512764f20cc0d71f3ffaad9b7de31
SHA256

efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c
SHA512

955dd0cc51295719bce2d2daa40e697cd63e6678028d5da737cdf76b59fbedac4ecbf2d8c93882b9ab4ebc5061cb9baab8e080bb8c932fdaadb4da4e13abea9c
SSDEEP

6144:siG1HlQiadBxsp1vmCO02ugWmhPPaqTtznImkYcskO025PQ29ms:siGAi+BoKNugGKt87akh0PQ0m

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000C4E45B4EB2331.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
1688	F4D55F6500014973000C4E45B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe
332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000C4E45B4EB2331.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000C4E45B4EB2331.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.exe\ = "F4D55"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\Content Type = "application/x-msdownload"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas\command	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\DefaultIcon	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open\command	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000C4E45B4EB2331\\F4D55F6500014973000C4E45B4EB2331.exe\" -s \"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.exe	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\%s	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\%s\ = "F4D55"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\DefaultIcon\ = "%1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\ = "Application"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start\command	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe
1688	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 1688	332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe	28
PID 332 wrote to memory of 1688	332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe	28
PID 332 wrote to memory of 1688	332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe	28
PID 332 wrote to memory of 1688	332	efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe	28

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000C4E45B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe
"C:\Users\Admin\AppData\Local\Temp\efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:332
- C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe
  "C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
352KB

MD5
1a9c7e67fee0bd287509a34382d91c59

SHA1
28944e2eb4a512764f20cc0d71f3ffaad9b7de31

SHA256
efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c

SHA512
955dd0cc51295719bce2d2daa40e697cd63e6678028d5da737cdf76b59fbedac4ecbf2d8c93882b9ab4ebc5061cb9baab8e080bb8c932fdaadb4da4e13abea9c

Download Submit
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
352KB

MD5
1a9c7e67fee0bd287509a34382d91c59

SHA1
28944e2eb4a512764f20cc0d71f3ffaad9b7de31

SHA256
efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c

SHA512
955dd0cc51295719bce2d2daa40e697cd63e6678028d5da737cdf76b59fbedac4ecbf2d8c93882b9ab4ebc5061cb9baab8e080bb8c932fdaadb4da4e13abea9c

Download Submit
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
352KB

MD5
1a9c7e67fee0bd287509a34382d91c59

SHA1
28944e2eb4a512764f20cc0d71f3ffaad9b7de31

SHA256
efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c

SHA512
955dd0cc51295719bce2d2daa40e697cd63e6678028d5da737cdf76b59fbedac4ecbf2d8c93882b9ab4ebc5061cb9baab8e080bb8c932fdaadb4da4e13abea9c

Download Submit
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
352KB

MD5
1a9c7e67fee0bd287509a34382d91c59

SHA1
28944e2eb4a512764f20cc0d71f3ffaad9b7de31

SHA256
efe149a1a83b0ebdc31c7081dd4162f1ab5e1ee456f15c03844898cec66f212c

SHA512
955dd0cc51295719bce2d2daa40e697cd63e6678028d5da737cdf76b59fbedac4ecbf2d8c93882b9ab4ebc5061cb9baab8e080bb8c932fdaadb4da4e13abea9c

Download Submit
memory/332-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/332-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/332-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1688-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1688-64-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads