e26856ee8c058fbed5b35acadc7bfbe61a4bdc7b24c3e9c944adb4f953f5a109

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:22

Target

308d3dda1ab8a16b017aa6813053b3b2.exe
Size

78KB
MD5

308d3dda1ab8a16b017aa6813053b3b2
SHA1

2599fb3bf0ae87bd9cbbe5d41dd5d55d10ac8390
SHA256

e26856ee8c058fbed5b35acadc7bfbe61a4bdc7b24c3e9c944adb4f953f5a109
SHA512

f97deea82dad7625a118d7bd4506282b74735f6f994ec05b2f896bd867da21ed92795dc13f2add01675ace92a01ec38eda4127e5621717707c051bf06b07835f
SSDEEP

1536:WdgF3iGc0QU87VeQ5hButGvwo/UQ4Z2ZlrS:vF3iGc0QUg32Gvj/UQ4ZqlrS

Score

10^/10

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	308d3dda1ab8a16b017aa6813053b3b2.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	308d3dda1ab8a16b017aa6813053b3b2.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	308d3dda1ab8a16b017aa6813053b3b2.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\ProgramData\wDtecwD\test123.exe = "C:\\ProgramData\\wDtecwD\\test123.exe:*:Enabled:IE"	308d3dda1ab8a16b017aa6813053b3b2.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	308d3dda1ab8a16b017aa6813053b3b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\AutoStartAgent = "0"	308d3dda1ab8a16b017aa6813053b3b2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\SystemConfigurationAgent = "0"	308d3dda1ab8a16b017aa6813053b3b2.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wDtec Update Client = "C:\\ProgramData\\wDtecwD\\test123.exe"	308d3dda1ab8a16b017aa6813053b3b2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4772	5056	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\308d3dda1ab8a16b017aa6813053b3b2.exe
"C:\Users\Admin\AppData\Local\Temp\308d3dda1ab8a16b017aa6813053b3b2.exe"
1⤵
- Modifies firewall policy service
- Windows security modification
- Adds Run key to start application
PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 424
  2⤵
  - Program crash
  PID:4772