05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e

General

Target

05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe
Size

702KB
MD5

009136149d2a77d34490ae96acf77a9f
SHA1

9fe056389f88a5f1b7923a210521d4ff5ca63113
SHA256

05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e
SHA512

a9fc78f2931fdefdaec8efdbe122b2f949afbcaefb6492cd9e8fbf34e2f42b7087607cff663aeb5c831bb94befcd45e2e3219a2129bc783777e9ba6ecf4e622d
SSDEEP

12288:sy901Ll5xHgC2eews+KBEk1kDJjIEPA92x/H9HXQbEZ0r7eaIiVSstVj:syyJeXBB18tLY92x/H9HAbPKqXv

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr532987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr532987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr532987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr532987.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr532987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr532987.exe

Executes dropped EXE 2 IoCs

pid	Process
4184	un842424.exe
1960	pr532987.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr532987.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr532987.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un842424.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un842424.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	pr532987.exe
1960	pr532987.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	pr532987.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4184	1104	05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe	79
PID 1104 wrote to memory of 4184	1104	05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe	79
PID 1104 wrote to memory of 4184	1104	05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe	79
PID 4184 wrote to memory of 1960	4184	un842424.exe	80
PID 4184 wrote to memory of 1960	4184	un842424.exe	80
PID 4184 wrote to memory of 1960	4184	un842424.exe	80

C:\Users\Admin\AppData\Local\Temp\05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe
"C:\Users\Admin\AppData\Local\Temp\05bb62bbaa282acf86235145f2598c708c06dd1cd5adbf230688296be6689b1e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un842424.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un842424.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr532987.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr532987.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un842424.exe

Filesize
548KB

MD5
285b0b66f013b9fbdaad94d16557f499

SHA1
d04c84e238a46173ffb789468725511d0fdd600f

SHA256
5f5864a574e6e157a62e09d813610eede05c8bdee790060e53c29fbdfa7c38ae

SHA512
71f4438894c21a53003ad2164f5fd3a237f3167c1b65090572149dc5ef453fb97dd1d0c74301b3a3dce41993c82edc6e910da7cabe4679652f07fd9bf0bd2d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un842424.exe

Filesize
548KB

MD5
285b0b66f013b9fbdaad94d16557f499

SHA1
d04c84e238a46173ffb789468725511d0fdd600f

SHA256
5f5864a574e6e157a62e09d813610eede05c8bdee790060e53c29fbdfa7c38ae

SHA512
71f4438894c21a53003ad2164f5fd3a237f3167c1b65090572149dc5ef453fb97dd1d0c74301b3a3dce41993c82edc6e910da7cabe4679652f07fd9bf0bd2d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr532987.exe

Filesize
278KB

MD5
631e45cffddbc4bde69f30a01d2fe053

SHA1
bd28628f772461c12fea699c7519885e0d167b83

SHA256
fe2808cb4f1599077cc6cc01d3bdccacd090902ea9cfe1d1f44e8ccd3e381587

SHA512
56425f27b3d740639116ebcb4e35dfb73e132e5acd7adb221624b03c4e61f670575bd87ba59f6fe45f3da1cbcfc0cd3ca5341610b98305826585f8f54383bf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr532987.exe

Filesize
278KB

MD5
631e45cffddbc4bde69f30a01d2fe053

SHA1
bd28628f772461c12fea699c7519885e0d167b83

SHA256
fe2808cb4f1599077cc6cc01d3bdccacd090902ea9cfe1d1f44e8ccd3e381587

SHA512
56425f27b3d740639116ebcb4e35dfb73e132e5acd7adb221624b03c4e61f670575bd87ba59f6fe45f3da1cbcfc0cd3ca5341610b98305826585f8f54383bf33

Download Submit
memory/1960-148-0x0000000002C80000-0x0000000002CAD000-memory.dmp

Filesize
180KB

Download
memory/1960-149-0x0000000000400000-0x0000000002BAF000-memory.dmp

Filesize
39.7MB

Download
memory/1960-150-0x0000000002C80000-0x0000000002CAD000-memory.dmp

Filesize
180KB

Download
memory/1960-151-0x0000000000400000-0x0000000002BAF000-memory.dmp

Filesize
39.7MB

Download
memory/1960-152-0x0000000007390000-0x0000000007934000-memory.dmp

Filesize
5.6MB

Download
memory/1960-153-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/1960-154-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/1960-155-0x0000000000400000-0x0000000002BAF000-memory.dmp

Filesize
39.7MB

Download
memory/1960-156-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/1960-157-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/1960-163-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-162-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-165-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-167-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-169-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-171-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-173-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-175-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-177-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-179-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-181-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-183-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-185-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-187-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download
memory/1960-189-0x0000000004CB0000-0x0000000004CC2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads