83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7

General

Target

83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
Size

364KB
MD5

8f4eaf1a248c91290da496a039aae41c
SHA1

36801dc7302cc07886e01127d301946d8b1fa0ee
SHA256

83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7
SHA512

b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c
SSDEEP

6144:zVNi6V+6v611GM+oY+aqw/Vdlc5HTcF/IntW2sKKth:ZNqF6en2/m1a/2sKKt

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000B9D42B4EB2331.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000B9D42B4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2028	F4D55F6500014973000B9D42B4EB2331.exe

Deletes itself 1 IoCs

pid	Process
2028	F4D55F6500014973000B9D42B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000B9D42B4EB2331.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000B9D42B4EB2331.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000B9D42B4EB2331\\F4D55F6500014973000B9D42B4EB2331.exe\" -s \"%1\" %*"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start\command	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.exe\ = "F4D55"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\DefaultIcon	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open\command	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\%s\ = "F4D55"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas\command	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.exe	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\Content Type = "application/x-msdownload"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\DefaultIcon\ = "%1"	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\%s	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\ = "Application"	F4D55F6500014973000B9D42B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas	F4D55F6500014973000B9D42B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*"	F4D55F6500014973000B9D42B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2028	F4D55F6500014973000B9D42B4EB2331.exe
2028	F4D55F6500014973000B9D42B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2028	1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe	28
PID 1228 wrote to memory of 2028	1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe	28
PID 1228 wrote to memory of 2028	1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe	28
PID 1228 wrote to memory of 2028	1228	83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe	28

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000B9D42B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
"C:\Users\Admin\AppData\Local\Temp\83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1228
- C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe
  "C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Deletes itself
  - Windows security modification
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe

Filesize
364KB

MD5
8f4eaf1a248c91290da496a039aae41c

SHA1
36801dc7302cc07886e01127d301946d8b1fa0ee

SHA256
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7

SHA512
b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c

Download Submit
C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe

Filesize
364KB

MD5
8f4eaf1a248c91290da496a039aae41c

SHA1
36801dc7302cc07886e01127d301946d8b1fa0ee

SHA256
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7

SHA512
b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c

Download Submit
\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe

Filesize
364KB

MD5
8f4eaf1a248c91290da496a039aae41c

SHA1
36801dc7302cc07886e01127d301946d8b1fa0ee

SHA256
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7

SHA512
b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c

Download Submit
\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe

Filesize
364KB

MD5
8f4eaf1a248c91290da496a039aae41c

SHA1
36801dc7302cc07886e01127d301946d8b1fa0ee

SHA256
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7

SHA512
b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c

Download Submit
memory/1228-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1228-55-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1228-63-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1228-65-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2028-62-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2028-64-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads