1083b44907a93bcf2a719171f330e35c7140d13a593150b584aab78871041bd2

General

Target

yT4pv51.exe
Size

525KB
MD5

862f74724189b690bd64f82358f82ba5
SHA1

ef612c2cfd7796a4cc8f095ee6b3f4ace784e97f
SHA256

1083b44907a93bcf2a719171f330e35c7140d13a593150b584aab78871041bd2
SHA512

1b515d5954f7b165627dea3ecec36c4d923d205b780b380e3643e62539fbe4409dd265690778e1fb7828ea50504838144d627c829a2ec8f209445b4679099ead
SSDEEP

12288:JMrxy90siPm6Tv6HtLE7s3PavYTxkaV/U4ZhtUhSQbL/7bt8RzmcH:syBiP7UMs/amxxNU4LtUEub7bkvH

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Executes dropped EXE 1 IoCs

pid	Process
4840	1si19ky0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	yT4pv51.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 2260	4840	1si19ky0.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
196	4840	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2260	AppLaunch.exe
2260	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4840	3720	yT4pv51.exe	71
PID 3720 wrote to memory of 4840	3720	yT4pv51.exe	71
PID 3720 wrote to memory of 4840	3720	yT4pv51.exe	71
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72
PID 4840 wrote to memory of 2260	4840	1si19ky0.exe	72

C:\Users\Admin\AppData\Local\Temp\yT4pv51.exe
"C:\Users\Admin\AppData\Local\Temp\yT4pv51.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1si19ky0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1si19ky0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 584
    3⤵
    - Program crash
    PID:196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1si19ky0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1si19ky0.exe

Filesize
890KB

MD5
e978c7e1a5be84e958419fdcecd0e1f0

SHA1
16990d1c40986a496472fe3221d9ceb981e25f4a

SHA256
e72e37b2e1966aa59d99102486d99e0cded9faded978cdb8e7b1e59e49c4cb14

SHA512
9fb36bc7791fa24cd8e87ab2fbe02079361f299a84866882b945fab775e44408d112543aced0735cb4aa6267fe8c325925a20ca643cd47b2bb3e07a2ba49484a

Download Submit
memory/2260-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2260-10-0x0000000072D20000-0x000000007340E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-19-0x0000000072D20000-0x000000007340E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-34-0x0000000072D20000-0x000000007340E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads