9a3897f11d513669c4217c16ed91e8e8f433d2bef651cfa96ba73a57e50f54ed

Analysis

max time kernel
147s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

481b36a8e1548f7cb3607379d5b514aa.exe
Size

380KB
MD5

481b36a8e1548f7cb3607379d5b514aa
SHA1

6e5e587868b28723685d71bcc97bea3b10e2fab9
SHA256

9a3897f11d513669c4217c16ed91e8e8f433d2bef651cfa96ba73a57e50f54ed
SHA512

e060aa2ace9d864f9faa12954fa897ea3ebb061ee8722a3f5ec8ebfd11d1559a66d131c8c1681250c289a3ac4eb6a4844b36405700d77a73ab1b34d0b3006cbc
SSDEEP

6144:FIM8B5qX9ze/4K6X9yFRXQ7lJAmV4+f/qwXj9R430PC+sUt3o5Fq/+Vh:+Lqq4F9iRoACqwzzC+7o5w/Wh

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	481b36a8e1548f7cb3607379d5b514aa.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
2872	043A6AEB00014973000C1B69B4EB2331.exe

Executes dropped EXE 1 IoCs

pid	Process
2872	043A6AEB00014973000C1B69B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6AEB00014973000C1B69B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	481b36a8e1548f7cb3607379d5b514aa.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	481b36a8e1548f7cb3607379d5b514aa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6AEB00014973000C1B69B4EB2331 = "C:\\ProgramData\\043A6AEB00014973000C1B69B4EB2331\\043A6AEB00014973000C1B69B4EB2331.exe"	043A6AEB00014973000C1B69B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2532	481b36a8e1548f7cb3607379d5b514aa.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	043A6AEB00014973000C1B69B4EB2331.exe
2872	043A6AEB00014973000C1B69B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2872	2532	481b36a8e1548f7cb3607379d5b514aa.exe	28
PID 2532 wrote to memory of 2872	2532	481b36a8e1548f7cb3607379d5b514aa.exe	28
PID 2532 wrote to memory of 2872	2532	481b36a8e1548f7cb3607379d5b514aa.exe	28
PID 2532 wrote to memory of 2872	2532	481b36a8e1548f7cb3607379d5b514aa.exe	28

C:\Users\Admin\AppData\Local\Temp\481b36a8e1548f7cb3607379d5b514aa.exe
"C:\Users\Admin\AppData\Local\Temp\481b36a8e1548f7cb3607379d5b514aa.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532
- C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe
  "C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\481b36a8e1548f7cb3607379d5b514aa.exe"
  2⤵
  - Windows security bypass
  - Deletes itself
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

Filesize
101KB

MD5
81e6f4ea55c460cf1dcb4d788cca3e4c

SHA1
201d05b3f962e9ceadb5018ff812b0699a920419

SHA256
ab6dcb317c6142dcabcf62ee8d20a043e6c074c2114d26a72341bf3d3f2af73a

SHA512
1a339a81afe20a10a0ef4ed6e45b6c9d2177c47319fa755db88a5c247689532f94a9c5b4533aecaf0e9a1034e01b73394ca01d71af09068ce449933dc9555e46

Download Submit
C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

Filesize
41KB

MD5
71df061083244b1ba5c2b31023aa6937

SHA1
9ca165c69ae111f6a7784cd42f9bb19631599361

SHA256
8446c9cbbe1bdf32ed15e2c47c452326490d1d33854ddf0c6b6d161a857a0bb9

SHA512
ad8bfb62d9463d6fefe9edad33b1a12ee8bad54249f264a5c059f2db304453a93e169a677c895d0448efb7273ff11b42d8b6ebaf3cf4fed49cc88793556af1e5

Download Submit
C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

Filesize
87KB

MD5
00046d28ba20cf09302ac5bf9a7ceddc

SHA1
4f3854be43516d1ecc7a679615013e5aada3e025

SHA256
1871d064851923f804a6e84147cf45cb6c2a6d5447b5fb54b786f3b0b4d72505

SHA512
b29f9fc61aed591772ea068c11b146afcbebe87fb19cbf68f02b0c942001029bce846f9ddd2658b1808833086a61f0f1f8f407a932f6f413f48356ccc142dee4

Download Submit
\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

Filesize
90KB

MD5
ae88b910c630e8300ed24ea61ceed15d

SHA1
630f62950033984742396cd383500c6f150a5f9f

SHA256
b60f7a22a2c3d4de68fe643eb916ed3876ebc46e56a28f9e8d47ea5aad0360c1

SHA512
3ac57994231d0f96fa1fec2c73798be5e21b6a2944f49e63271884b79fd0684f1ae506625ef0b3ae9162df5fa30bddd73fd3935900bc44745de83f092507ae5a

Download Submit
\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

Filesize
48KB

MD5
cdb7831fd8a3084c9f1ccd07e83a519c

SHA1
8f12476687fa4291a44a22b4fa798578385a2f53

SHA256
0bc25d6d3746bcd76e8dc33048d4d87aaaec6cb4b4ba78413314ad7c7ffa95b8

SHA512
6425d7470e8748f903e912316941ed385fbbc677aad2a39f54ed7bcb516be08892ad8c8805b0f401552564b576eb45bb6dc7720752f8f258635ac45d7ea20cb1

Download Submit
memory/2532-0-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2532-2-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/2532-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2532-20-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2532-28-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2872-11-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2872-12-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2872-21-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2872-30-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2872-36-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download