6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf

General

Target

6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe
Size

1.1MB
MD5

e8a86a61d31c80bea50b9c35a6e0d951
SHA1

8a088307c7e947a549196c9b534ececa02b71475
SHA256

6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf
SHA512

2bbecb1e66e251a8c275e0bf985f0dd0c76bb101fa5df14c43d47b8387b69c469b53bd0ed495d5a3aff3ff4450f16e5875b1251775826ca2da94d35cc042e50d
SSDEEP

24576:4y/wmT0mhiuY806jJPAp+CRgKVQV1489E9AJ9ymi://wGXhnYCJPwJgjM89E9AJ

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	186071140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	186071140.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	186071140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	186071140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	186071140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	186071140.exe

Executes dropped EXE 3 IoCs

pid	Process
3896	jg534520.exe
228	NF964145.exe
1608	186071140.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	186071140.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	186071140.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	jg534520.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	jg534520.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	NF964145.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	NF964145.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4816	1608	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	186071140.exe
1608	186071140.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	186071140.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3896	4916	6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe	79
PID 4916 wrote to memory of 3896	4916	6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe	79
PID 4916 wrote to memory of 3896	4916	6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe	79
PID 3896 wrote to memory of 228	3896	jg534520.exe	80
PID 3896 wrote to memory of 228	3896	jg534520.exe	80
PID 3896 wrote to memory of 228	3896	jg534520.exe	80
PID 228 wrote to memory of 1608	228	NF964145.exe	81
PID 228 wrote to memory of 1608	228	NF964145.exe	81
PID 228 wrote to memory of 1608	228	NF964145.exe	81

C:\Users\Admin\AppData\Local\Temp\6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe
"C:\Users\Admin\AppData\Local\Temp\6afa50e4ba851f5fc380ff38f3bc40e0a1ffad4a9ef884b6e19eecb0b66911bf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jg534520.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jg534520.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF964145.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF964145.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\186071140.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\186071140.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1084
        5⤵
        Program crash
        
        PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1608 -ip 1608
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jg534520.exe

Filesize
764KB

MD5
ce1699ce802bc23b393c24e636a51762

SHA1
4307fb8994f1c9769146a134d215ec7954080ef3

SHA256
39ce43ee14751ef373bc888b8754db2aa49049dd6cb14548106570c351a2a050

SHA512
a5463f847b43e9c5e24a5d396655378d7c0ab214e6659f8bba54f693127426082c54eb810e0b75e0dcb152df09e36d690c7c519d19fd6cf5e689948eb0769a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jg534520.exe

Filesize
764KB

MD5
ce1699ce802bc23b393c24e636a51762

SHA1
4307fb8994f1c9769146a134d215ec7954080ef3

SHA256
39ce43ee14751ef373bc888b8754db2aa49049dd6cb14548106570c351a2a050

SHA512
a5463f847b43e9c5e24a5d396655378d7c0ab214e6659f8bba54f693127426082c54eb810e0b75e0dcb152df09e36d690c7c519d19fd6cf5e689948eb0769a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF964145.exe

Filesize
592KB

MD5
2d29f9d3224b387a1d5f5354ba161687

SHA1
31dc996ccf26661fc0db2b751a8beac368a4b98d

SHA256
b2dfdf6757a8314e140d0980a336c0ddf349a1b10e7c98e72b5a47b754705c7a

SHA512
be64999182ef53711e090e3f8f788ef2c0c27aa5b33c82c76b4a43840250d4ad0044b467f290c046d4bae70c727af4394bf75fa850d90977d08653ca0a010957

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF964145.exe

Filesize
592KB

MD5
2d29f9d3224b387a1d5f5354ba161687

SHA1
31dc996ccf26661fc0db2b751a8beac368a4b98d

SHA256
b2dfdf6757a8314e140d0980a336c0ddf349a1b10e7c98e72b5a47b754705c7a

SHA512
be64999182ef53711e090e3f8f788ef2c0c27aa5b33c82c76b4a43840250d4ad0044b467f290c046d4bae70c727af4394bf75fa850d90977d08653ca0a010957

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\186071140.exe

Filesize
377KB

MD5
60431a01946a01c11b9a297eac8a75c2

SHA1
7c5862d45e94a37880a7aa483cdf660378cf4dd7

SHA256
6b937893ebc175451cf8ffd1e3fc966dccc592e5951df58c685973aa2c7ef647

SHA512
4f9d2a27204a3de6c07cee8ca38ede297a34c3c320b97cf477732bbbdb9ddca028be747e404b9e3d722278991a36ebc45bd7bd47e34719449d9cee3fb43790bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\186071140.exe

Filesize
377KB

MD5
60431a01946a01c11b9a297eac8a75c2

SHA1
7c5862d45e94a37880a7aa483cdf660378cf4dd7

SHA256
6b937893ebc175451cf8ffd1e3fc966dccc592e5951df58c685973aa2c7ef647

SHA512
4f9d2a27204a3de6c07cee8ca38ede297a34c3c320b97cf477732bbbdb9ddca028be747e404b9e3d722278991a36ebc45bd7bd47e34719449d9cee3fb43790bc

Download Submit
memory/1608-155-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/1608-156-0x0000000004F60000-0x0000000005504000-memory.dmp

Filesize
5.6MB

Download
memory/1608-157-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1608-158-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1608-159-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-162-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-160-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-164-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-166-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-168-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-170-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-172-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-174-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-176-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-178-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-180-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-182-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-184-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-186-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/1608-187-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/1608-188-0x0000000000810000-0x000000000083D000-memory.dmp

Filesize
180KB

Download
memory/1608-189-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1608-190-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1608-191-0x0000000004F50000-0x0000000004F60000-memory.dmp

Filesize
64KB

Download
memory/1608-195-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads