8feddc2f985038ac0fd42c37a8b359ac7d9c816f82707110db8dbe7c8206a268

General

Target

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Size

81KB
MD5

f4713c8ac5fc1e4919156157e7bece19
SHA1

7bd9e35b1d1210183bbb4fe1995895cbc1692c62
SHA256

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b
SHA512

ecff8f3af212f444b5f44fd3bfd922556a49b9156fd7a20e13ebc60b4abe08b9d193a49556d4a8e776ef8083db77ab9667ec537dd44f863719e83cb3899cb46f
SSDEEP

1536:mLzDqNFmav82qCqYoOrW5LpiP3sCPhX4W5AICHK:2HXOS7OeUkegRHK

Score

10^/10

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

Processes:

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvpplvcr.exe"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvpplvcr.exe"	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

Drops file in Windows directory 2 IoCs

Processes:

2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe

description	ioc	process
File created	C:\Windows\sysvpplvcr.exe	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe
File opened for modification	C:\Windows\sysvpplvcr.exe	2be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b.exe