Analysis
- max time kernel
13s - max time network
113s - platform
windows10_x64 - resource
win10v200722 - submitted
10/10/2020, 04:17
General
- Target ds2.exe
- Size 100KB
- Sample201010-dp4rf64tr2
- SHA256 d1d245f4d408bf9dbaed6c59f68c995e427d95bd8316cc358377ec7ee43fb2f2
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ds2.exe"C:\Users\Admin\AppData\Local\Temp\ds2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ds2.exe"C:\Users\Admin\AppData\Local\Temp\ds2.exe"2⤵
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2112-15-0x0000000007530000-0x0000000007531000-memory.dmp
memory/2112-13-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/2112-35-0x0000000009930000-0x0000000009931000-memory.dmp
memory/2112-33-0x0000000009940000-0x0000000009941000-memory.dmp
memory/2112-32-0x0000000009990000-0x0000000009991000-memory.dmp
memory/2112-31-0x00000000097D0000-0x00000000097D1000-memory.dmp
memory/2112-14-0x00000000078A0000-0x00000000078A1000-memory.dmp
memory/2112-12-0x0000000073CA0000-0x000000007438E000-memory.dmp
memory/2112-21-0x00000000087C0000-0x00000000087C1000-memory.dmp
memory/2112-30-0x0000000009450000-0x0000000009451000-memory.dmp
memory/2112-23-0x0000000009470000-0x00000000094A3000-memory.dmp
memory/2112-20-0x0000000008770000-0x0000000008771000-memory.dmp
memory/2112-17-0x0000000007ED0000-0x0000000007ED1000-memory.dmp
memory/2112-18-0x00000000080B0000-0x00000000080B1000-memory.dmp
memory/2112-19-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/2112-16-0x00000000076E0000-0x00000000076E1000-memory.dmp
memory/2196-0-0x0000000073CA0000-0x000000007438E000-memory.dmp
memory/2196-3-0x0000000004F40000-0x0000000004F56000-memory.dmp
memory/2196-1-0x00000000007E0000-0x00000000007E1000-memory.dmp
memory/2196-4-0x0000000002A00000-0x0000000002A0D000-memory.dmp
memory/3192-8-0x0000000073CA0000-0x000000007438E000-memory.dmp
memory/3192-5-0x0000000000400000-0x0000000000408000-memory.dmp