c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d

General

Target

c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe
Size

360KB
MD5

3c2fd776ca591b01a20db3680f4d8957
SHA1

b024253352f42c3aa46bb0d115ff2801a6b4ef18
SHA256

c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d
SHA512

91db8782d19f4d166be23697346de44545c96071964a63f83825efa515ecf95c6523938ab4f374e2c913ae9161563a2d081775181c021d56268d57f71eed3d47
SSDEEP

6144:51LauoQovqo11IFiIWNFzGuIO7g2ZZNuGxjH+Fy94tYBUaRBMFLtggkJ3u:jeQAqqfKROFZNuG9gtYeaRaWzJ3

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CA680B4EB2331.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CA680B4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
948	F4D55F6500014973000CA680B4EB2331.exe

Deletes itself 1 IoCs

pid	Process
948	F4D55F6500014973000CA680B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe
896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	F4D55F6500014973000CA680B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	F4D55F6500014973000CA680B4EB2331.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CA680B4EB2331.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\start\command	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\%s\ = "F4D55"	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\Content Type = "application/x-msdownload"	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\DefaultIcon\ = "%1"	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\open	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\runas\command	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*"	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\%s	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\open\command	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000CA680B4EB2331\\F4D55F6500014973000CA680B4EB2331.exe\" -s \"%1\" %*"	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*"	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\runas	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*"	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\ = "F4D55"	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55	F4D55F6500014973000CA680B4EB2331.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\ = "Application"	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\DefaultIcon	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\F4D55\shell\start	F4D55F6500014973000CA680B4EB2331.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe	F4D55F6500014973000CA680B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
948	F4D55F6500014973000CA680B4EB2331.exe
948	F4D55F6500014973000CA680B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 948	896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe	27
PID 896 wrote to memory of 948	896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe	27
PID 896 wrote to memory of 948	896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe	27
PID 896 wrote to memory of 948	896	c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe	27

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	F4D55F6500014973000CA680B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe
"C:\Users\Admin\AppData\Local\Temp\c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896
- C:\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe
  "C:\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Deletes itself
  - Windows security modification
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe

Filesize
360KB

MD5
3c2fd776ca591b01a20db3680f4d8957

SHA1
b024253352f42c3aa46bb0d115ff2801a6b4ef18

SHA256
c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d

SHA512
91db8782d19f4d166be23697346de44545c96071964a63f83825efa515ecf95c6523938ab4f374e2c913ae9161563a2d081775181c021d56268d57f71eed3d47

Download Submit
C:\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe

Filesize
360KB

MD5
3c2fd776ca591b01a20db3680f4d8957

SHA1
b024253352f42c3aa46bb0d115ff2801a6b4ef18

SHA256
c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d

SHA512
91db8782d19f4d166be23697346de44545c96071964a63f83825efa515ecf95c6523938ab4f374e2c913ae9161563a2d081775181c021d56268d57f71eed3d47

Download Submit
\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe

Filesize
360KB

MD5
3c2fd776ca591b01a20db3680f4d8957

SHA1
b024253352f42c3aa46bb0d115ff2801a6b4ef18

SHA256
c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d

SHA512
91db8782d19f4d166be23697346de44545c96071964a63f83825efa515ecf95c6523938ab4f374e2c913ae9161563a2d081775181c021d56268d57f71eed3d47

Download Submit
\ProgramData\F4D55F6500014973000CA680B4EB2331\F4D55F6500014973000CA680B4EB2331.exe

Filesize
360KB

MD5
3c2fd776ca591b01a20db3680f4d8957

SHA1
b024253352f42c3aa46bb0d115ff2801a6b4ef18

SHA256
c38fb8307983c49174c54e58a7d737ef6b4d9ec34d188b76dce08d78c712b24d

SHA512
91db8782d19f4d166be23697346de44545c96071964a63f83825efa515ecf95c6523938ab4f374e2c913ae9161563a2d081775181c021d56268d57f71eed3d47

Download Submit
memory/896-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/896-60-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/896-64-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/948-62-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/948-63-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads