49eddeaab9aead5ecc9024f5dcf4b41d34defdabdabdaefec279a9eda39182d3 | Triage

Analysis

max time kernel
3s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 18:26 UTC

Sharing

Report Analysis Logs

General

Target

ef6ea81fd46eea7611f49d2f5ed335d3.exe
Size

393KB
MD5

ef6ea81fd46eea7611f49d2f5ed335d3
SHA1

4990c82f90046b9b6d11d837fbbe516e74802a91
SHA256

49eddeaab9aead5ecc9024f5dcf4b41d34defdabdabdaefec279a9eda39182d3
SHA512

470bd52dc0e990d6360ab084e33abaf69204114211acae263958c6c08d01799b122a811591c865599138b67877016fa460998f4ae295bedbcc5da235a65d1449
SSDEEP

6144:YTwxg7dUShNmPhlen1GJw9B1uqY1dZHhptjYUxevM79lWzuDRsxyYZvy0TDjM7Pz:Dg7dUmmLen1G6Lkjr7plWzuDRsVqdkY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000BB725B4EB2331.exe

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2708	043A6A5B00014973000BB725B4EB2331.exe

Loads dropped DLL 2 IoCs

pid	Process
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000BB725B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000BB725B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ef6ea81fd46eea7611f49d2f5ed335d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000BB725B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000BB725B4EB2331.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000BB725B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000BB725B4EB2331\\043A6A5B00014973000BB725B4EB2331.exe"	043A6A5B00014973000BB725B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe
2708	043A6A5B00014973000BB725B4EB2331.exe
2708	043A6A5B00014973000BB725B4EB2331.exe
2708	043A6A5B00014973000BB725B4EB2331.exe
2708	043A6A5B00014973000BB725B4EB2331.exe
2708	043A6A5B00014973000BB725B4EB2331.exe
2708	043A6A5B00014973000BB725B4EB2331.exe
2708	043A6A5B00014973000BB725B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2708	2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe	17
PID 2996 wrote to memory of 2708	2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe	17
PID 2996 wrote to memory of 2708	2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe	17
PID 2996 wrote to memory of 2708	2996	ef6ea81fd46eea7611f49d2f5ed335d3.exe	17

C:\Users\Admin\AppData\Local\Temp\ef6ea81fd46eea7611f49d2f5ed335d3.exe
"C:\Users\Admin\AppData\Local\Temp\ef6ea81fd46eea7611f49d2f5ed335d3.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996
- C:\ProgramData\043A6A5B00014973000BB725B4EB2331\043A6A5B00014973000BB725B4EB2331.exe
  "C:\ProgramData\043A6A5B00014973000BB725B4EB2331\043A6A5B00014973000BB725B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\ef6ea81fd46eea7611f49d2f5ed335d3.exe"
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2708

Network

No results found

178.162.132.116:80

ef6ea81fd46eea7611f49d2f5ed335d3.exe

152 B
3
178.162.132.116:80

043A6A5B00014973000BB725B4EB2331.exe

152 B
3
178.162.132.116:80

152 B
3
178.162.132.116:80

152 B
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-28-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-38-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-22-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-23-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/2708-21-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-17-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-44-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-39-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2708-19-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2996-1-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/2996-3-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/2996-0-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2996-5-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2996-27-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2996-35-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2996-4-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2996-6-0x0000000000410000-0x00000000004D8000-memory.dmp

Filesize
800KB

Download
memory/2996-7-0x0000000001FE0000-0x0000000001FE2000-memory.dmp

Filesize
8KB

Download