15c1952117c92b90f9d4d109e4fb0372edc4ecaaa6f75c1080f526638db760ff

General

Target

0f64927f808872134002e6c476853034.exe
Size

468KB
MD5

0f64927f808872134002e6c476853034
SHA1

b9e32759db2cd93f447a86a4c3320c70bac9d56c
SHA256

15c1952117c92b90f9d4d109e4fb0372edc4ecaaa6f75c1080f526638db760ff
SHA512

6af064ba577e446f462a317d697e1eb89437abc9e1f8fbb53aaf0edab22860840e49c08fbfbb159641a90301b21ee9e0ea7ad550d64b95857aaa4bbd03acb186
SSDEEP

6144:+HmfZ+FNDNTaceRgD/qO5DPRi3sV6QwtaBShaeTPiu5jcczFJLTraf:+HjFTacWYDPl6QwQksUisjz7Xra

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	0f64927f808872134002e6c476853034.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2968	043A6A5B00014973000A239CB4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	0f64927f808872134002e6c476853034.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	0f64927f808872134002e6c476853034.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000A239CB4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000A239CB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	0f64927f808872134002e6c476853034.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	0f64927f808872134002e6c476853034.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	0f64927f808872134002e6c476853034.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000A239CB4EB2331 = "C:\\ProgramData\\043A6A5B00014973000A239CB4EB2331\\043A6A5B00014973000A239CB4EB2331.exe"	043A6A5B00014973000A239CB4EB2331.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe
3012	0f64927f808872134002e6c476853034.exe
2968	043A6A5B00014973000A239CB4EB2331.exe
2968	043A6A5B00014973000A239CB4EB2331.exe
2968	043A6A5B00014973000A239CB4EB2331.exe
2968	043A6A5B00014973000A239CB4EB2331.exe
2968	043A6A5B00014973000A239CB4EB2331.exe
2968	043A6A5B00014973000A239CB4EB2331.exe
2968	043A6A5B00014973000A239CB4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2968	3012	0f64927f808872134002e6c476853034.exe	17
PID 3012 wrote to memory of 2968	3012	0f64927f808872134002e6c476853034.exe	17
PID 3012 wrote to memory of 2968	3012	0f64927f808872134002e6c476853034.exe	17
PID 3012 wrote to memory of 2968	3012	0f64927f808872134002e6c476853034.exe	17

C:\Users\Admin\AppData\Local\Temp\0f64927f808872134002e6c476853034.exe
"C:\Users\Admin\AppData\Local\Temp\0f64927f808872134002e6c476853034.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012
- C:\ProgramData\043A6A5B00014973000A239CB4EB2331\043A6A5B00014973000A239CB4EB2331.exe
  "C:\ProgramData\043A6A5B00014973000A239CB4EB2331\043A6A5B00014973000A239CB4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\0f64927f808872134002e6c476853034.exe"
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-13-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2968-11-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2968-18-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2968-28-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2968-29-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2968-34-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/3012-1-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/3012-2-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/3012-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3012-17-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/3012-25-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads