1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3

General

Target

1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe
Size

745KB
MD5

29f9809ebadb5ed7ac23ba6555a94235
SHA1

bd16e2d86b2fe8cabc2eb88c8c84731646cac0ef
SHA256

1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3
SHA512

378bd7f1661b72799acc9debe7531b641db30165431cca5511c10474a2298b6ea9473802a00fc805a9deae41d95d5384ebdc5741e7f0818185dd8c42fe750dde
SSDEEP

12288:1y905lNXBw0dkJldaaTBxqS4ztv38bccc7S79ciazwuMH/SJF1k9y5BtQXKUXxSF:1yOEkCdaaVgSCvMbcccuqiakuMfSJfBT

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	43121693.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	43121693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	43121693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	43121693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	43121693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	43121693.exe

Executes dropped EXE 2 IoCs

pid	Process
2236	un671221.exe
2452	43121693.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	43121693.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	43121693.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un671221.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un671221.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	2452	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2452	43121693.exe
2452	43121693.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	43121693.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 2236	3944	1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe	80
PID 3944 wrote to memory of 2236	3944	1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe	80
PID 3944 wrote to memory of 2236	3944	1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe	80
PID 2236 wrote to memory of 2452	2236	un671221.exe	81
PID 2236 wrote to memory of 2452	2236	un671221.exe	81
PID 2236 wrote to memory of 2452	2236	un671221.exe	81

C:\Users\Admin\AppData\Local\Temp\1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe
"C:\Users\Admin\AppData\Local\Temp\1f9136a5321c729373e90b451fe128a3e1811de2db3118519357078ae13a12e3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un671221.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un671221.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43121693.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43121693.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1096
      4⤵
      Program crash
      PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2452 -ip 2452
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un671221.exe

Filesize
591KB

MD5
cb0745947b2d418df4e66f14f3b2c1de

SHA1
f5044bcd4f0fe5f529bb5fd5d4894e081c520738

SHA256
418de19263eca1f0dbf46d1840ca3477b67c00f35d67c7db5c1fc7e7651b74a6

SHA512
1c15c5d3ceff659e46f413a03336fecae2c68b783dabc3d2b91228aee49a9dfab90bbec33dadfb159b02fce173efb6ea43df3d783e75c93961e22eecfe549cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un671221.exe

Filesize
591KB

MD5
cb0745947b2d418df4e66f14f3b2c1de

SHA1
f5044bcd4f0fe5f529bb5fd5d4894e081c520738

SHA256
418de19263eca1f0dbf46d1840ca3477b67c00f35d67c7db5c1fc7e7651b74a6

SHA512
1c15c5d3ceff659e46f413a03336fecae2c68b783dabc3d2b91228aee49a9dfab90bbec33dadfb159b02fce173efb6ea43df3d783e75c93961e22eecfe549cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43121693.exe

Filesize
376KB

MD5
4c7d0d429de0fa47f1fb05da48448983

SHA1
a9cbe417bbbf0eaf686251584f3947c35b913a8a

SHA256
cb32eb1079f63b7c3ab94821595570cd5429e22817b51420101d770431133744

SHA512
ba486da3778666a49359131b09999fbfa1d1649f6becd63872a9a0f2b26d133d8e90c7eeeef26ef30b0d39121ca2450ed34a4b0ec9360c6228f1eabaf2540b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43121693.exe

Filesize
376KB

MD5
4c7d0d429de0fa47f1fb05da48448983

SHA1
a9cbe417bbbf0eaf686251584f3947c35b913a8a

SHA256
cb32eb1079f63b7c3ab94821595570cd5429e22817b51420101d770431133744

SHA512
ba486da3778666a49359131b09999fbfa1d1649f6becd63872a9a0f2b26d133d8e90c7eeeef26ef30b0d39121ca2450ed34a4b0ec9360c6228f1eabaf2540b6b

Download Submit
memory/2452-161-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-167-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-151-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/2452-152-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2452-153-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2452-154-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2452-155-0x00000000050A0000-0x0000000005644000-memory.dmp

Filesize
5.6MB

Download
memory/2452-157-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2452-158-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2452-160-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-149-0x0000000000A20000-0x0000000000A4D000-memory.dmp

Filesize
180KB

Download
memory/2452-163-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-165-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-150-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2452-169-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-171-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-173-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-175-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-177-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-179-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-181-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-183-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-185-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-187-0x0000000002980000-0x0000000002992000-memory.dmp

Filesize
72KB

Download
memory/2452-195-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads