93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
Size

434KB
MD5

319848dbc3724d061e6e87384d919b34
SHA1

13ef19cca1bba224cade67d8f72a3df5470a7cf0
SHA256

93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54
SHA512

c9a0a6ab5857dcc91030ede32e2678fb243299f210bfe9476dc312eda9eb69acdb5d542fa64a4e3a3db459f30b1f96912e3a579c8d7e985374c1f89f41c78e9e
SSDEEP

12288:tJQkmUWMO/yA/sRYSSeJkddIAXraYCmFTK1hR5yf:twHHqA/BePAhCAO/n

Score

10^/10

evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe

Executes dropped EXE 1 IoCs

pid	Process
3756	start_game.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3452	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
3756	start_game.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\moe_map\moe_map.log	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
File created	C:\Windows\moe.sys	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
File created	C:\Windows\steam_app.dll	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
File created	C:\Windows\start_game.exe	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
File opened for modification	C:\Windows\moe_map\moe_map.log	start_game.exe
File opened for modification	C:\Windows\moe_map\global.dat	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
File opened for modification	C:\Windows\start_game.exe	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
File opened for modification	C:\Windows\moe_map\global.dat	start_game.exe
File opened for modification	C:\Windows\moe_map\au.dat	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3956	powershell.exe
3956	powershell.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe
3756	start_game.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
Token: SeDebugPrivilege	3756	start_game.exe
Token: SeDebugPrivilege	3956	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3452	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
3756	start_game.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3956	3452	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe	89
PID 3452 wrote to memory of 3956	3452	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe	89
PID 3452 wrote to memory of 3956	3452	93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe	89

C:\Users\Admin\AppData\Local\Temp\93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe
"C:\Users\Admin\AppData\Local\Temp\93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54.exe"
1⤵
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath "C:\Windows"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956

C:\Windows\start_game.exe
C:\Windows\start_game.exe -k
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\start_game.exe

Filesize
434KB

MD5
319848dbc3724d061e6e87384d919b34

SHA1
13ef19cca1bba224cade67d8f72a3df5470a7cf0

SHA256
93b4a78bb63c9ff71d52f66644566bf08da8a13a4a7c64ad85796a7bafe3ba54

SHA512
c9a0a6ab5857dcc91030ede32e2678fb243299f210bfe9476dc312eda9eb69acdb5d542fa64a4e3a3db459f30b1f96912e3a579c8d7e985374c1f89f41c78e9e

Download Submit
memory/3452-57-0x0000000001080000-0x000000000115E000-memory.dmp

Filesize
888KB

Download
memory/3452-56-0x0000000001080000-0x000000000115E000-memory.dmp

Filesize
888KB

Download
memory/3452-0-0x0000000001080000-0x000000000115E000-memory.dmp

Filesize
888KB

Download
memory/3756-8-0x0000000002CA0000-0x0000000002D7E000-memory.dmp

Filesize
888KB

Download
memory/3756-13-0x0000000002CA0000-0x0000000002D7E000-memory.dmp

Filesize
888KB

Download
memory/3956-42-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/3956-44-0x0000000007720000-0x0000000007D9A000-memory.dmp

Filesize
6.5MB

Download
memory/3956-16-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/3956-15-0x0000000005700000-0x0000000005766000-memory.dmp

Filesize
408KB

Download
memory/3956-26-0x00000000057E0000-0x0000000005B34000-memory.dmp

Filesize
3.3MB

Download
memory/3956-10-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/3956-27-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

Filesize
120KB

Download
memory/3956-28-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

Filesize
304KB

Download
memory/3956-12-0x00000000050D0000-0x00000000056F8000-memory.dmp

Filesize
6.2MB

Download
memory/3956-43-0x0000000006FA0000-0x0000000007043000-memory.dmp

Filesize
652KB

Download
memory/3956-11-0x00000000024B0000-0x00000000024C0000-memory.dmp

Filesize
64KB

Download
memory/3956-41-0x0000000006D80000-0x0000000006D9E000-memory.dmp

Filesize
120KB

Download
memory/3956-45-0x00000000070E0000-0x00000000070FA000-memory.dmp

Filesize
104KB

Download
memory/3956-14-0x0000000004E00000-0x0000000004E22000-memory.dmp

Filesize
136KB

Download
memory/3956-46-0x0000000007150000-0x000000000715A000-memory.dmp

Filesize
40KB

Download
memory/3956-31-0x000000006FB40000-0x000000006FB8C000-memory.dmp

Filesize
304KB

Download
memory/3956-47-0x0000000007360000-0x00000000073F6000-memory.dmp

Filesize
600KB

Download
memory/3956-48-0x00000000072E0000-0x00000000072F1000-memory.dmp

Filesize
68KB

Download
memory/3956-30-0x0000000006380000-0x00000000063B2000-memory.dmp

Filesize
200KB

Download
memory/3956-29-0x000000007FDB0000-0x000000007FDC0000-memory.dmp

Filesize
64KB

Download
memory/3956-50-0x0000000007320000-0x0000000007334000-memory.dmp

Filesize
80KB

Download
memory/3956-52-0x0000000007400000-0x0000000007408000-memory.dmp

Filesize
32KB

Download
memory/3956-51-0x0000000007420000-0x000000000743A000-memory.dmp

Filesize
104KB

Download
memory/3956-49-0x0000000007310000-0x000000000731E000-memory.dmp

Filesize
56KB

Download
memory/3956-55-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/3956-9-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/3956-7-0x00000000024C0000-0x00000000024F6000-memory.dmp

Filesize
216KB

Download