4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3

General

Target

4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe
Size

360KB
MD5

3a9fbd43fea6701ab3111db334660d38
SHA1

98855962827d60522eb91f11be00d2969471f147
SHA256

4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3
SHA512

8f4e4ebff99f79358b43337eda9fa0e8f27daffa965691a738a4e421fcda382210df82939205f6e5218483e1ae04f93511df0136b5299c8bcd7e349ca54bef52
SSDEEP

6144:KSy+bnr+Fp0yN90QEdGayzdq9+slMoebwSdLdQsJM9i7yT48gAaXh:2Mrty90Gah98lt/Qs6zc5x

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	knTi12GV54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	knTi12GV54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ljdH59li82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ljdH59li82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	knTi12GV54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	knTi12GV54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ljdH59li82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ljdH59li82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ljdH59li82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ljdH59li82.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	knTi12GV54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	knTi12GV54.exe

Executes dropped EXE 2 IoCs

pid	Process
1268	knTi12GV54.exe
1916	ljdH59li82.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	knTi12GV54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	knTi12GV54.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ljdH59li82.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3628	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	1268	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1268	knTi12GV54.exe
1268	knTi12GV54.exe
1916	ljdH59li82.exe
1916	ljdH59li82.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	knTi12GV54.exe
Token: SeDebugPrivilege	1916	ljdH59li82.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1268	3760	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe	84
PID 3760 wrote to memory of 1268	3760	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe	84
PID 3760 wrote to memory of 1268	3760	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe	84
PID 3760 wrote to memory of 1916	3760	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe	90
PID 3760 wrote to memory of 1916	3760	4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe	90

C:\Users\Admin\AppData\Local\Temp\4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe
"C:\Users\Admin\AppData\Local\Temp\4dc320c75d8a5f17c2f1709ce46a4ff455e68e5f11e0a4f6ef817e34f9fb67e3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\knTi12GV54.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\knTi12GV54.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1080
    3⤵
    - Program crash
    PID:4752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ljdH59li82.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ljdH59li82.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1268 -ip 1268
1⤵
PID:1944

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\knTi12GV54.exe

Filesize
362KB

MD5
5d81e061f10a4717c5280a205a96b146

SHA1
f576d4064f994a265b98a3b504a0e128699b0ee2

SHA256
4f5e241ccb185ff012b1867db8220ab0dc50e72f7a59c4eb58dbe9292f120f9e

SHA512
a6dd3707251edca7f42acad1e643e35ef6786302bc2e530905bf854473b2c1548acecddba8f7430e6ed41d7839e10d0ef4db0a19b2b9e0e00b7bd1d2ffa657dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\knTi12GV54.exe

Filesize
362KB

MD5
5d81e061f10a4717c5280a205a96b146

SHA1
f576d4064f994a265b98a3b504a0e128699b0ee2

SHA256
4f5e241ccb185ff012b1867db8220ab0dc50e72f7a59c4eb58dbe9292f120f9e

SHA512
a6dd3707251edca7f42acad1e643e35ef6786302bc2e530905bf854473b2c1548acecddba8f7430e6ed41d7839e10d0ef4db0a19b2b9e0e00b7bd1d2ffa657dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ljdH59li82.exe

Filesize
12KB

MD5
2ec4640232b1848ae68845f48a57f912

SHA1
f104382796c69ca74f3c3305774819a738fc672f

SHA256
a73dee9964005b1f37bf42680cb70acad7355ca2d481e0f4dd39036b870dd22e

SHA512
db88d8f58550872a2a57bd2ae09900661ca92805f209652dc039f659a696da2b38e57f56fdf5922f50d968f4eada29361ef34fdf5b656c92867058f053a5be26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ljdH59li82.exe

Filesize
12KB

MD5
2ec4640232b1848ae68845f48a57f912

SHA1
f104382796c69ca74f3c3305774819a738fc672f

SHA256
a73dee9964005b1f37bf42680cb70acad7355ca2d481e0f4dd39036b870dd22e

SHA512
db88d8f58550872a2a57bd2ae09900661ca92805f209652dc039f659a696da2b38e57f56fdf5922f50d968f4eada29361ef34fdf5b656c92867058f053a5be26

Download Submit
memory/1268-159-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-165-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-144-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1268-146-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-147-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-149-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-151-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-153-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-155-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-157-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-143-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1268-161-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-163-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-145-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1268-167-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-169-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-171-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-173-0x0000000007140000-0x0000000007152000-memory.dmp

Filesize
72KB

Download
memory/1268-174-0x0000000000400000-0x0000000002BC8000-memory.dmp

Filesize
39.8MB

Download
memory/1268-175-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1268-176-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1268-177-0x00000000072D0000-0x00000000072E0000-memory.dmp

Filesize
64KB

Download
memory/1268-179-0x0000000000400000-0x0000000002BC8000-memory.dmp

Filesize
39.8MB

Download
memory/1268-142-0x0000000002BD0000-0x0000000002BFD000-memory.dmp

Filesize
180KB

Download
memory/1268-141-0x00000000072E0000-0x0000000007884000-memory.dmp

Filesize
5.6MB

Download
memory/1916-183-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads