04a52e80435493eafbca0c65d0489c5de8f34f4a6dba800e2a7901dabbb2650d

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23c8ee12c7e7269d8916a3f5fb47247a.exe
Size

408KB
MD5

23c8ee12c7e7269d8916a3f5fb47247a
SHA1

42ce6816420fcd03a1b60a10947f0dcad120ad91
SHA256

04a52e80435493eafbca0c65d0489c5de8f34f4a6dba800e2a7901dabbb2650d
SHA512

06752929a57401670b0952dc93d5bb5948aa46c27c762f2c7f828adeda5a61aa43774a93ecdfde89a76f885a5afbf8532e3eab59370f1e5e4071364d84b722cd
SSDEEP

12288:mhx9AzWa1HkSApRP9vbXuHuhYdK6Y91W:9Wa1aP9vruHuhYd491W

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000AFC62B4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
2396	043A6A5B00014973000AFC62B4EB2331.exe

Executes dropped EXE 1 IoCs

pid	Process
2396	043A6A5B00014973000AFC62B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	23c8ee12c7e7269d8916a3f5fb47247a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000AFC62B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	23c8ee12c7e7269d8916a3f5fb47247a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000AFC62B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000AFC62B4EB2331\\043A6A5B00014973000AFC62B4EB2331.exe"	043A6A5B00014973000AFC62B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2028	23c8ee12c7e7269d8916a3f5fb47247a.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	043A6A5B00014973000AFC62B4EB2331.exe
2396	043A6A5B00014973000AFC62B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2396	2028	23c8ee12c7e7269d8916a3f5fb47247a.exe	28
PID 2028 wrote to memory of 2396	2028	23c8ee12c7e7269d8916a3f5fb47247a.exe	28
PID 2028 wrote to memory of 2396	2028	23c8ee12c7e7269d8916a3f5fb47247a.exe	28
PID 2028 wrote to memory of 2396	2028	23c8ee12c7e7269d8916a3f5fb47247a.exe	28

C:\Users\Admin\AppData\Local\Temp\23c8ee12c7e7269d8916a3f5fb47247a.exe
"C:\Users\Admin\AppData\Local\Temp\23c8ee12c7e7269d8916a3f5fb47247a.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\ProgramData\043A6A5B00014973000AFC62B4EB2331\043A6A5B00014973000AFC62B4EB2331.exe
  "C:\ProgramData\043A6A5B00014973000AFC62B4EB2331\043A6A5B00014973000AFC62B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\23c8ee12c7e7269d8916a3f5fb47247a.exe"
  2⤵
  - Windows security bypass
  - Deletes itself
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\043A6A5B00014973000AFC62B4EB2331\043A6A5B00014973000AFC62B4EB2331.exe

Filesize
274KB

MD5
39a260bb62119c97f7990a2f8bc1fd32

SHA1
cab56b6a0ca50c01693df1f52c6318b1b60308f5

SHA256
bbcdd1c70549c7707703887e9df069ee497f4272d1c8ef01d70ae5e675b1e552

SHA512
aa03ea0bd8382bd96a8d6b873062dd10f76b911406a68dbc8d8dbe806d380330cd19f68184bd29664bb61176b2d4a18efeff5fb3398c9729a2e872405aca8659

Download Submit
C:\ProgramData\043A6A5B00014973000AFC62B4EB2331\043A6A5B00014973000AFC62B4EB2331.exe

Filesize
256KB

MD5
7146934511dd3bb3967afb783ed3025b

SHA1
5b77d6bb4b444c2be7121e60b56622da2cf37184

SHA256
3a0f1cb96ce38a091979ef29a1055f46fc2c4052df870a21cb4abd714b88c75e

SHA512
ccb604eef8b7e9a2085641413acd73d15a471e42594101d678f5c6532c00d34de0c8a360cac380dcb803688f5a5a4527881a405e576fe375134b84759e167544

Download Submit
\ProgramData\043A6A5B00014973000AFC62B4EB2331\043A6A5B00014973000AFC62B4EB2331.exe

Filesize
408KB

MD5
23c8ee12c7e7269d8916a3f5fb47247a

SHA1
42ce6816420fcd03a1b60a10947f0dcad120ad91

SHA256
04a52e80435493eafbca0c65d0489c5de8f34f4a6dba800e2a7901dabbb2650d

SHA512
06752929a57401670b0952dc93d5bb5948aa46c27c762f2c7f828adeda5a61aa43774a93ecdfde89a76f885a5afbf8532e3eab59370f1e5e4071364d84b722cd

Download Submit
memory/2028-19-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2028-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2028-2-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2028-1-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2028-25-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2028-17-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2396-11-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2396-18-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2396-12-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2396-28-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2396-29-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download
memory/2396-34-0x0000000000410000-0x0000000000502000-memory.dmp

Filesize
968KB

Download