e26856ee8c058fbed5b35acadc7bfbe61a4bdc7b24c3e9c944adb4f953f5a109

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:22

Target

308d3dda1ab8a16b017aa6813053b3b2.exe
Size

78KB
MD5

308d3dda1ab8a16b017aa6813053b3b2
SHA1

2599fb3bf0ae87bd9cbbe5d41dd5d55d10ac8390
SHA256

e26856ee8c058fbed5b35acadc7bfbe61a4bdc7b24c3e9c944adb4f953f5a109
SHA512

f97deea82dad7625a118d7bd4506282b74735f6f994ec05b2f896bd867da21ed92795dc13f2add01675ace92a01ec38eda4127e5621717707c051bf06b07835f
SSDEEP

1536:WdgF3iGc0QU87VeQ5hButGvwo/UQ4Z2ZlrS:vF3iGc0QUg32Gvj/UQ4ZqlrS

Score

10^/10

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	308d3dda1ab8a16b017aa6813053b3b2.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\ProgramData\wDtecwD\test123.exe = "C:\\ProgramData\\wDtecwD\\test123.exe:*:Enabled:IE"	308d3dda1ab8a16b017aa6813053b3b2.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	308d3dda1ab8a16b017aa6813053b3b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\AutoStartAgent = "0"	308d3dda1ab8a16b017aa6813053b3b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\SystemConfigurationAgent = "0"	308d3dda1ab8a16b017aa6813053b3b2.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\wDtec Update Client = "C:\\ProgramData\\wDtecwD\\test123.exe"	308d3dda1ab8a16b017aa6813053b3b2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	2448	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 848	2448	308d3dda1ab8a16b017aa6813053b3b2.exe	29
PID 2448 wrote to memory of 848	2448	308d3dda1ab8a16b017aa6813053b3b2.exe	29
PID 2448 wrote to memory of 848	2448	308d3dda1ab8a16b017aa6813053b3b2.exe	29
PID 2448 wrote to memory of 848	2448	308d3dda1ab8a16b017aa6813053b3b2.exe	29

C:\Users\Admin\AppData\Local\Temp\308d3dda1ab8a16b017aa6813053b3b2.exe
"C:\Users\Admin\AppData\Local\Temp\308d3dda1ab8a16b017aa6813053b3b2.exe"
1⤵
- Modifies firewall policy service
- Windows security modification
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 176
  2⤵
  - Program crash
  PID:848