d2fe2084c9fb5045eb41769e002614ba9fde7a89ec4dcddeb37d1caee26b5e3e

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3847a45eaa36b54a1e294cbab84809a6.exe
Size

388KB
MD5

3847a45eaa36b54a1e294cbab84809a6
SHA1

636f5f46f3d66cff1d33b66fdfcad6e18b7e9eae
SHA256

d2fe2084c9fb5045eb41769e002614ba9fde7a89ec4dcddeb37d1caee26b5e3e
SHA512

88cfd31dc1ee2135e4c6e38cdf01e5fac8f4b54cd88e28359e01b74e817910eca049bb36ba0d2e94c42a6aad21aca628d86e43d95839f8110e42769fcbea0a40
SSDEEP

12288:S9xJ83oE2R6jhLOS8pA2j5kSJdjVmEOHHEcCj:UxJkobRSI3Pj5tROHHSj

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6AEB00014973000A814AB4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
2364	043A6AEB00014973000A814AB4EB2331.exe

Executes dropped EXE 1 IoCs

pid	Process
2364	043A6AEB00014973000A814AB4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6AEB00014973000A814AB4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6AEB00014973000A814AB4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6AEB00014973000A814AB4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3847a45eaa36b54a1e294cbab84809a6.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	3847a45eaa36b54a1e294cbab84809a6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6AEB00014973000A814AB4EB2331.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6AEB00014973000A814AB4EB2331 = "C:\\ProgramData\\043A6AEB00014973000A814AB4EB2331\\043A6AEB00014973000A814AB4EB2331.exe"	043A6AEB00014973000A814AB4EB2331.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe
1968	3847a45eaa36b54a1e294cbab84809a6.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	043A6AEB00014973000A814AB4EB2331.exe
2364	043A6AEB00014973000A814AB4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2364	1968	3847a45eaa36b54a1e294cbab84809a6.exe	16
PID 1968 wrote to memory of 2364	1968	3847a45eaa36b54a1e294cbab84809a6.exe	16
PID 1968 wrote to memory of 2364	1968	3847a45eaa36b54a1e294cbab84809a6.exe	16
PID 1968 wrote to memory of 2364	1968	3847a45eaa36b54a1e294cbab84809a6.exe	16

C:\Users\Admin\AppData\Local\Temp\3847a45eaa36b54a1e294cbab84809a6.exe
"C:\Users\Admin\AppData\Local\Temp\3847a45eaa36b54a1e294cbab84809a6.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe
  "C:\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\3847a45eaa36b54a1e294cbab84809a6.exe"
  2⤵
  - Windows security bypass
  - Deletes itself
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe

Filesize
47KB

MD5
236c5e3f21360d434678ad0f25b0b029

SHA1
1197209572b85df7dbf226b2f25e16581975e5ff

SHA256
8be90e7ddc93d0fb410a46a5a14dc1a2d6aaee8f4fa75bdbb32935bce7cc4297

SHA512
b525800a53e1ba857f9c23ab52bef72a855068e831b264dbb8a6b0c5a157f016754aeea4a4d2426a655fbb4a3dfa621d081db6161fc50dfd7b70076aab140f85

Download Submit
C:\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe

Filesize
21KB

MD5
5b3685e09a27a8fe716ee7170688cbfe

SHA1
0dead9dad42b36bed1dd5963101ee104c29c2f1d

SHA256
0d84512893b651e0cb45b408f2f0441675833f9f2b5fe553cec01757e03e21c3

SHA512
c235492e03d4befa700b0fc920a6cdfeef133afdcc1cbb88c6356b34229e620341a181f4e47084296d8fbf43827e2d06db223e8df265ea27ba9b66428496df4f

Download Submit
C:\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe

Filesize
75KB

MD5
2eab00ecd14665ab7b77446e5505e1a5

SHA1
eb059d23a793c3caf932b68f96d2a530bc37a625

SHA256
1b5b3664251ffa31fbb74679915204029f41b2b86b13428713c735db596a2ee3

SHA512
8a3138cccf6988d343679f25e381880ce06a5d13ec7c2a9ba64a9cfbf547350184d22a611e50fd45ef61e59141270a92986f267b5eb9a0e927a7f1a75ea0bcf7

Download Submit
\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe

Filesize
41KB

MD5
60068068bd395c5a0e16523d1eb536b8

SHA1
1893c54831cd1145085e71428c975d95b8ea4efd

SHA256
278ea4f19ade10cd3901ecf89aec5213193cda352d699a51bb0fafdf97b08e94

SHA512
650834fe7e78928de4dd84c5c10c81a013c54fdfe1de121a12fab1c929dadd57b34356a670ebd138dc9fb2253c3422efd9cf15a3592d2ef30cf7317b5483c5d9

Download Submit
\ProgramData\043A6AEB00014973000A814AB4EB2331\043A6AEB00014973000A814AB4EB2331.exe

Filesize
36KB

MD5
da6807f86762635f218c139b4c0666a1

SHA1
d675ef2577580e19bc5ccb218eb777885e7ee66a

SHA256
3d5b77ac8f5a72453bbaaeaee373d0016e115e80d899ae33e38e9ca75e06c16a

SHA512
90a83068b4a8a38237ae696aa885a67e39de7d0fa4f2ee3d07c490825cff6e30b7f109ca4f253a46f7adfc1ad66eff7031ea331e2df364cb5bf224d475088d78

Download Submit
memory/1968-20-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1968-1-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1968-2-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1968-18-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1968-0-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1968-27-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2364-12-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2364-11-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2364-19-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2364-30-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2364-36-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download