bdd89c26fd26a0baf92a21e6aafbc29d98c5dfae091c5de966ccc5855f9b454b

General

Target

73a6c94086c2d8e464f4dd178dfdd3e0.exe
Size

119KB
MD5

73a6c94086c2d8e464f4dd178dfdd3e0
SHA1

0e91b40022ac78375fcf66751ee45794331a10e8
SHA256

bdd89c26fd26a0baf92a21e6aafbc29d98c5dfae091c5de966ccc5855f9b454b
SHA512

86c0d3feff43e6a0ba21feab25b19e238e06fc4f23ee6da2e03db4f1972f314e396994ac0378a9e01b554e55b1de4cdbf5208d37ce0a61ab2560664a9f71efa6
SSDEEP

3072:1rvYsJDoTbT+3r6iJiYHqYJGBWzcJvHJ:CjA6mzjJGBC4v

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	qwert.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qwert.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	73a6c94086c2d8e464f4dd178dfdd3e0.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	qwert.exe

Deletes itself 1 IoCs

pid	Process
1944	qwert.exe

Executes dropped EXE 1 IoCs

pid	Process
1944	qwert.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	qwert.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	qwert.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\qwert.exe	73a6c94086c2d8e464f4dd178dfdd3e0.exe
File opened for modification	C:\Windows\qwert.exe	73a6c94086c2d8e464f4dd178dfdd3e0.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	qwert.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	qwert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	qwert.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	qwert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	qwert.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	qwert.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	73a6c94086c2d8e464f4dd178dfdd3e0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	qwert.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	qwert.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	73a6c94086c2d8e464f4dd178dfdd3e0.exe

C:\Users\Admin\AppData\Local\Temp\73a6c94086c2d8e464f4dd178dfdd3e0.exe
"C:\Users\Admin\AppData\Local\Temp\73a6c94086c2d8e464f4dd178dfdd3e0.exe"
1⤵
- Looks for VMWare Tools registry key
- Drops file in Windows directory
- Modifies registry class
PID:2284

C:\Windows\qwert.exe
"C:\Windows\qwert.exe"
1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qwert.exe

Filesize
119KB

MD5
73a6c94086c2d8e464f4dd178dfdd3e0

SHA1
0e91b40022ac78375fcf66751ee45794331a10e8

SHA256
bdd89c26fd26a0baf92a21e6aafbc29d98c5dfae091c5de966ccc5855f9b454b

SHA512
86c0d3feff43e6a0ba21feab25b19e238e06fc4f23ee6da2e03db4f1972f314e396994ac0378a9e01b554e55b1de4cdbf5208d37ce0a61ab2560664a9f71efa6

Download Submit
memory/1944-11-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-14-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-4-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-7-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-9-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-10-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-21-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-20-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-13-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1944-19-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2284-6-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2284-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads