bdd89c26fd26a0baf92a21e6aafbc29d98c5dfae091c5de966ccc5855f9b454b

General

Target

73a6c94086c2d8e464f4dd178dfdd3e0.exe
Size

119KB
MD5

73a6c94086c2d8e464f4dd178dfdd3e0
SHA1

0e91b40022ac78375fcf66751ee45794331a10e8
SHA256

bdd89c26fd26a0baf92a21e6aafbc29d98c5dfae091c5de966ccc5855f9b454b
SHA512

86c0d3feff43e6a0ba21feab25b19e238e06fc4f23ee6da2e03db4f1972f314e396994ac0378a9e01b554e55b1de4cdbf5208d37ce0a61ab2560664a9f71efa6
SSDEEP

3072:1rvYsJDoTbT+3r6iJiYHqYJGBWzcJvHJ:CjA6mzjJGBC4v

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	qwert.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	qwert.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	73a6c94086c2d8e464f4dd178dfdd3e0.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	qwert.exe

Deletes itself 1 IoCs

pid	Process
4192	qwert.exe

Executes dropped EXE 1 IoCs

pid	Process
4192	qwert.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qwert.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	qwert.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\qwert.exe	73a6c94086c2d8e464f4dd178dfdd3e0.exe
File opened for modification	C:\Windows\qwert.exe	73a6c94086c2d8e464f4dd178dfdd3e0.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	qwert.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	73a6c94086c2d8e464f4dd178dfdd3e0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	73a6c94086c2d8e464f4dd178dfdd3e0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	qwert.exe

C:\Users\Admin\AppData\Local\Temp\73a6c94086c2d8e464f4dd178dfdd3e0.exe
"C:\Users\Admin\AppData\Local\Temp\73a6c94086c2d8e464f4dd178dfdd3e0.exe"
1⤵
- Looks for VMWare Tools registry key
- Drops file in Windows directory
- Modifies registry class
PID:1124

C:\Windows\qwert.exe
"C:\Windows\qwert.exe"
1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Modifies registry class
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qwert.exe

Filesize
119KB

MD5
73a6c94086c2d8e464f4dd178dfdd3e0

SHA1
0e91b40022ac78375fcf66751ee45794331a10e8

SHA256
bdd89c26fd26a0baf92a21e6aafbc29d98c5dfae091c5de966ccc5855f9b454b

SHA512
86c0d3feff43e6a0ba21feab25b19e238e06fc4f23ee6da2e03db4f1972f314e396994ac0378a9e01b554e55b1de4cdbf5208d37ce0a61ab2560664a9f71efa6

Download Submit
memory/1124-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1124-5-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-10-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-8-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-9-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-7-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-11-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-12-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-14-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-18-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4192-19-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads