a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22

General

Target

a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe
Size

340KB
MD5

4ab4851ddff98c42cdf52c16b35d5633
SHA1

a95bff0e88f69971a24a6adab6484fd299c59659
SHA256

a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22
SHA512

2676c005d5dc3f8f5a73e76b2c0443f94e5a5ce81e28041e1d6976082f83bb64225be8a4170a715740f447ec2ee075ab98e9bb3a2abfc6ae5b854bf662126eff
SSDEEP

6144:nVhaY4BMf6rp29y9RkK4O6OfksPQsUvM/0jH6ne/m5fMLyU4zfHP/Gv:nVhmBMg2q4wksP/B/iH64m5ktAHGv

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000C4E45B4EB2331.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
300	F4D55F6500014973000C4E45B4EB2331.exe

Deletes itself 1 IoCs

pid	Process
300	F4D55F6500014973000C4E45B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe
288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000C4E45B4EB2331.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000C4E45B4EB2331.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\%s	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\Content Type = "application/x-msdownload"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\DefaultIcon	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000C4E45B4EB2331\\F4D55F6500014973000C4E45B4EB2331.exe\" -s \"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas\command	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.exe\ = "F4D55"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\%s\ = "F4D55"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open\command	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\.exe	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\ = "Application"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\DefaultIcon\ = "%1"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start\command	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe
300	F4D55F6500014973000C4E45B4EB2331.exe
300	F4D55F6500014973000C4E45B4EB2331.exe
300	F4D55F6500014973000C4E45B4EB2331.exe
300	F4D55F6500014973000C4E45B4EB2331.exe
300	F4D55F6500014973000C4E45B4EB2331.exe
300	F4D55F6500014973000C4E45B4EB2331.exe
300	F4D55F6500014973000C4E45B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 300	288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe	28
PID 288 wrote to memory of 300	288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe	28
PID 288 wrote to memory of 300	288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe	28
PID 288 wrote to memory of 300	288	a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe	28

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000C4E45B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe
"C:\Users\Admin\AppData\Local\Temp\a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288
- C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe
  "C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Deletes itself
  - Windows security modification
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
340KB

MD5
4ab4851ddff98c42cdf52c16b35d5633

SHA1
a95bff0e88f69971a24a6adab6484fd299c59659

SHA256
a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22

SHA512
2676c005d5dc3f8f5a73e76b2c0443f94e5a5ce81e28041e1d6976082f83bb64225be8a4170a715740f447ec2ee075ab98e9bb3a2abfc6ae5b854bf662126eff

Download Submit
C:\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
340KB

MD5
4ab4851ddff98c42cdf52c16b35d5633

SHA1
a95bff0e88f69971a24a6adab6484fd299c59659

SHA256
a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22

SHA512
2676c005d5dc3f8f5a73e76b2c0443f94e5a5ce81e28041e1d6976082f83bb64225be8a4170a715740f447ec2ee075ab98e9bb3a2abfc6ae5b854bf662126eff

Download Submit
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
340KB

MD5
4ab4851ddff98c42cdf52c16b35d5633

SHA1
a95bff0e88f69971a24a6adab6484fd299c59659

SHA256
a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22

SHA512
2676c005d5dc3f8f5a73e76b2c0443f94e5a5ce81e28041e1d6976082f83bb64225be8a4170a715740f447ec2ee075ab98e9bb3a2abfc6ae5b854bf662126eff

Download Submit
\ProgramData\F4D55F6500014973000C4E45B4EB2331\F4D55F6500014973000C4E45B4EB2331.exe

Filesize
340KB

MD5
4ab4851ddff98c42cdf52c16b35d5633

SHA1
a95bff0e88f69971a24a6adab6484fd299c59659

SHA256
a47549b8c5ea5113e7ce84e4598aed64c8cf7d78e69b3e55e8efa1cb2df50f22

SHA512
2676c005d5dc3f8f5a73e76b2c0443f94e5a5ce81e28041e1d6976082f83bb64225be8a4170a715740f447ec2ee075ab98e9bb3a2abfc6ae5b854bf662126eff

Download Submit
memory/288-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/288-55-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/288-63-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/288-64-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/300-62-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads