ee48174864ae0ef8c1e2da6b91b17c2f1df32195f69173adcc3013bf97c76ad5

Analysis

max time kernel
132s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Size

392KB
MD5

5aa283477dee06012b7cf3272b3617d4
SHA1

a56749e2b405ba5f9539d785340fba1cee2dbbe9
SHA256

c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77
SHA512

a9233017351fe0757232cb7594d08300672ce3fa927cbdcf0ec5b1cef9425aa7b2e1fbf22239d1fc311d70994cf7cb3d3d13eef4d6a836af88e226f512e77222
SSDEEP

6144:O6ittMEfv0StbaV3jjb8TyD3cX5d+sF+TDa4ZUb5dR3vwxKO9jqs:OXsSMlXbQX5dT0DRE5T4x

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe043A6A5B00014973000B88E7B4EB2331.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000B88E7B4EB2331.exe

Disables taskbar notifications via registry modification
evasion
Deletes itself 1 IoCs

Processes:

043A6A5B00014973000B88E7B4EB2331.exe

pid process

2480 043A6A5B00014973000B88E7B4EB2331.exe
Executes dropped EXE 1 IoCs

Processes:

043A6A5B00014973000B88E7B4EB2331.exe

pid process

2480 043A6A5B00014973000B88E7B4EB2331.exe

Loads dropped DLL 4 IoCs

Processes:

c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe043A6A5B00014973000B88E7B4EB2331.exe

pid	process
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

043A6A5B00014973000B88E7B4EB2331.exec086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	043A6A5B00014973000B88E7B4EB2331.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	043A6A5B00014973000B88E7B4EB2331.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	043A6A5B00014973000B88E7B4EB2331.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

043A6A5B00014973000B88E7B4EB2331.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000B88E7B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000B88E7B4EB2331\\043A6A5B00014973000B88E7B4EB2331.exe"	043A6A5B00014973000B88E7B4EB2331.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe043A6A5B00014973000B88E7B4EB2331.exe

pid	process
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

043A6A5B00014973000B88E7B4EB2331.exe

pid	process
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

043A6A5B00014973000B88E7B4EB2331.exe

pid	process
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe
2480	043A6A5B00014973000B88E7B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

043A6A5B00014973000B88E7B4EB2331.exe

pid process

2480 043A6A5B00014973000B88E7B4EB2331.exe
2480 043A6A5B00014973000B88E7B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe

description	pid	process	target process
PID 2156 wrote to memory of 2480	2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe	043A6A5B00014973000B88E7B4EB2331.exe
PID 2156 wrote to memory of 2480	2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe	043A6A5B00014973000B88E7B4EB2331.exe
PID 2156 wrote to memory of 2480	2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe	043A6A5B00014973000B88E7B4EB2331.exe
PID 2156 wrote to memory of 2480	2156	c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe	043A6A5B00014973000B88E7B4EB2331.exe

C:\Users\Admin\AppData\Local\Temp\c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe
"C:\Users\Admin\AppData\Local\Temp\c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe"
1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156

C:\ProgramData\043A6A5B00014973000B88E7B4EB2331\043A6A5B00014973000B88E7B4EB2331.exe
"C:\ProgramData\043A6A5B00014973000B88E7B4EB2331\043A6A5B00014973000B88E7B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77.exe"
2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\043A6A5B00014973000B88E7B4EB2331\043A6A5B00014973000B88E7B4EB2331.exe
Filesize
392KB

MD5
5aa283477dee06012b7cf3272b3617d4

SHA1
a56749e2b405ba5f9539d785340fba1cee2dbbe9

SHA256
c086172b03dbcdc6a782dfbbbf1b6b7f71551bc0d10e1044fcd3c7e880e83a77

SHA512
a9233017351fe0757232cb7594d08300672ce3fa927cbdcf0ec5b1cef9425aa7b2e1fbf22239d1fc311d70994cf7cb3d3d13eef4d6a836af88e226f512e77222

Download Submit
memory/2156-0-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2156-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2156-2-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2156-20-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2156-27-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2480-11-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2480-12-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2480-21-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2480-30-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2480-36-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2480-42-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download