f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4

General

Target
f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Size 1.7MB
Sample240214-gla5aaag8z
SHA256 f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4
MD5 c3d7abe1b3219e62e7afd9be41a71c12
SHA1 e3fbea9da267c6fb01799310d36110b594100d64
SHA512 676dc9202cc85fe7fb4922503547a7940444fdda9a2ebf927841a200673819c31e278e87dd78b865e8fd259aabbe6cea5e6822b08c9ee4aacea413b211a68acd
SSDEEP 49152:jI0Mykez9xO/fbKecU0GwGA9cySrb76c1FC6vS:jIVepxO3bKebHV76cXC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 3 IoCs

resource	yara_rule
behavioral2/memory/4540-3-0x0000000000D60000-0x00000000011BC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4540-4-0x0000000000D60000-0x00000000011BC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4540-10-0x0000000000D60000-0x00000000011BC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4540	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4540	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
4540	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
4540	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
4540	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe

C:\Users\Admin\AppData\Local\Temp\f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe
"C:\Users\Admin\AppData\Local\Temp\f1ca484ee483d8e3bf9b4068d3f374ba5f87647f0fe816ec33761468ef1b63e4.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540