86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe
Size

137KB
MD5

7c1376ee97291445f7a9ad3645ef4100
SHA1

101ed30c8f284886227c2fef18df87136e515f86
SHA256

86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6
SHA512

5a0dfebc8b0f2d56a88c4a7718e7fe9b446638f145b2990a0edbe70dfee03154098cc399d3c2a6e664a758bc1f1dfee9c440650cc41d9f9348c5c33e21238cbd
SSDEEP

3072:7v17hMz+Q2eKaRA3Rv4MuM3lGsSTwsST9Y7rkq7/Hm:57Sz+QhKaRA3Rv4Mu2lrSTBST9Y7rkYu

Score

10^/10

evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reconstructed.exe"	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reconstructed.exe	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reconstructed.exe	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reconstructed.exe"	86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe

C:\Users\Admin\AppData\Local\Temp\86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe
"C:\Users\Admin\AppData\Local\Temp\86950835ce30b33e5b538f46915860717379a78fcfe6439974fcb6d127a6dea6N.exe"
1⤵
- Windows security bypass
- Drops startup file
- Windows security modification
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads