fb9db8f382bd7ec0440806950366e555ef79d327bf4608b924e7980723499890

General

Target

z8246341.exe
Size

325KB
MD5

012e5510dd4e65c0abff8c52ed819a78
SHA1

fb5eed262000dabb42a2356568fb8f5a0aefcd73
SHA256

fb9db8f382bd7ec0440806950366e555ef79d327bf4608b924e7980723499890
SHA512

8fa9cc0b8b980585213c1f1fb3371a996086fec9b45aec8d0a74fe3235e9e92968cb82d8d8f74a5d61aac404adf4f6421ddec3627531d2d2420cb3edfc318bbb
SSDEEP

6144:KSy+bnr+pp0yN90QE7wrqnDMxPzT2hn1RNecbr7IUdXV:qMr9y90sqn4BTSznDIUT

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q3215306.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q3215306.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q3215306.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q3215306.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q3215306.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q3215306.exe

Executes dropped EXE 2 IoCs

pid	Process
2104	q3215306.exe
2968	r5543521.exe

Loads dropped DLL 4 IoCs

pid	Process
3064	z8246341.exe
2104	q3215306.exe
3064	z8246341.exe
2968	r5543521.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	q3215306.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	q3215306.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	z8246341.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2104	q3215306.exe
2104	q3215306.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	q3215306.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2104	3064	z8246341.exe	28
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29
PID 3064 wrote to memory of 2968	3064	z8246341.exe	29

C:\Users\Admin\AppData\Local\Temp\z8246341.exe
"C:\Users\Admin\AppData\Local\Temp\z8246341.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\q3215306.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\q3215306.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5543521.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5543521.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\q3215306.exe

Filesize
184KB

MD5
7868bdf1097be0b3e6abaaa809a96d9c

SHA1
a565e5ba9745f48d4791126bd9f6eaffcb0f5f7a

SHA256
2ab6209ffe3cde29adf1f70d9ac0afa462d07ff9ac9a2481f090a6cc80803d43

SHA512
afc83cc82aa7418becb58d3340ca3b97d1408a2852c09cc38de938735cec5fcca291764ca6bc54e9379ad640f3191218ccd75c645e43b1bab20780b7ef82fd05

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\q3215306.exe

Filesize
184KB

MD5
7868bdf1097be0b3e6abaaa809a96d9c

SHA1
a565e5ba9745f48d4791126bd9f6eaffcb0f5f7a

SHA256
2ab6209ffe3cde29adf1f70d9ac0afa462d07ff9ac9a2481f090a6cc80803d43

SHA512
afc83cc82aa7418becb58d3340ca3b97d1408a2852c09cc38de938735cec5fcca291764ca6bc54e9379ad640f3191218ccd75c645e43b1bab20780b7ef82fd05

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5543521.exe

Filesize
141KB

MD5
df1a54b0ce9f42275a825eeb5daef830

SHA1
7a1e2b07e77caaee421d44173ecfd578cdd57d99

SHA256
4727a2e6a30bebebfaaa5560ba8aaee5a6aaf54e66822b37088be97bc07e0f40

SHA512
2ede071911b1c3355671bc120c7fbbab7bba3303f9458d80e8d0deeba9ad03fc7d3f474210a49bdff7e493bc4599afd5ee60e308f2e4df889522353c702b9ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5543521.exe

Filesize
141KB

MD5
df1a54b0ce9f42275a825eeb5daef830

SHA1
7a1e2b07e77caaee421d44173ecfd578cdd57d99

SHA256
4727a2e6a30bebebfaaa5560ba8aaee5a6aaf54e66822b37088be97bc07e0f40

SHA512
2ede071911b1c3355671bc120c7fbbab7bba3303f9458d80e8d0deeba9ad03fc7d3f474210a49bdff7e493bc4599afd5ee60e308f2e4df889522353c702b9ad5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\q3215306.exe

Filesize
184KB

MD5
7868bdf1097be0b3e6abaaa809a96d9c

SHA1
a565e5ba9745f48d4791126bd9f6eaffcb0f5f7a

SHA256
2ab6209ffe3cde29adf1f70d9ac0afa462d07ff9ac9a2481f090a6cc80803d43

SHA512
afc83cc82aa7418becb58d3340ca3b97d1408a2852c09cc38de938735cec5fcca291764ca6bc54e9379ad640f3191218ccd75c645e43b1bab20780b7ef82fd05

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\q3215306.exe

Filesize
184KB

MD5
7868bdf1097be0b3e6abaaa809a96d9c

SHA1
a565e5ba9745f48d4791126bd9f6eaffcb0f5f7a

SHA256
2ab6209ffe3cde29adf1f70d9ac0afa462d07ff9ac9a2481f090a6cc80803d43

SHA512
afc83cc82aa7418becb58d3340ca3b97d1408a2852c09cc38de938735cec5fcca291764ca6bc54e9379ad640f3191218ccd75c645e43b1bab20780b7ef82fd05

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5543521.exe

Filesize
141KB

MD5
df1a54b0ce9f42275a825eeb5daef830

SHA1
7a1e2b07e77caaee421d44173ecfd578cdd57d99

SHA256
4727a2e6a30bebebfaaa5560ba8aaee5a6aaf54e66822b37088be97bc07e0f40

SHA512
2ede071911b1c3355671bc120c7fbbab7bba3303f9458d80e8d0deeba9ad03fc7d3f474210a49bdff7e493bc4599afd5ee60e308f2e4df889522353c702b9ad5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\r5543521.exe

Filesize
141KB

MD5
df1a54b0ce9f42275a825eeb5daef830

SHA1
7a1e2b07e77caaee421d44173ecfd578cdd57d99

SHA256
4727a2e6a30bebebfaaa5560ba8aaee5a6aaf54e66822b37088be97bc07e0f40

SHA512
2ede071911b1c3355671bc120c7fbbab7bba3303f9458d80e8d0deeba9ad03fc7d3f474210a49bdff7e493bc4599afd5ee60e308f2e4df889522353c702b9ad5

Download Submit
memory/2104-23-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-33-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-19-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-21-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-15-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-25-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-27-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-29-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-31-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-17-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-35-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-37-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-39-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-13-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-12-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2104-11-0x00000000004E0000-0x00000000004FC000-memory.dmp

Filesize
112KB

Download
memory/2104-10-0x0000000000360000-0x000000000037E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads