dcad9f659dc4eba1e24a19a68661e64aee4c4ba1e9465fab91535c3db50dfe5a

Analysis

max time kernel
53s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
08/12/2020, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13f4b7e1f2c04b807975514036ca9c09.exe
Size 550KB
Sample201208-g2xhlt5adn
SHA256 dcad9f659dc4eba1e24a19a68661e64aee4c4ba1e9465fab91535c3db50dfe5a
MD5 13f4b7e1f2c04b807975514036ca9c09
SHA1 d4c7c66769d9b5be18f68777590d9369dd9a057f
SHA512 b07b95bc4bc9b41a98212b58b9ad0b47d58fcc04867f781528e1070c80af53a3902c90bbe632386ed3dc9e822aa456ff20a04992eb04666a47805ebc5fe9236c
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

Malware Config

Signatures

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/904-7-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral1/memory/904-8-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral1/memory/904-9-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral1/memory/904-10-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	13f4b7e1f2c04b807975514036ca9c09.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	13f4b7e1f2c04b807975514036ca9c09.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	powershell.exe
436	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 1696 wrote to memory of 904	1696	13f4b7e1f2c04b807975514036ca9c09.exe	29
PID 904 wrote to memory of 436	904	13f4b7e1f2c04b807975514036ca9c09.exe	30
PID 904 wrote to memory of 436	904	13f4b7e1f2c04b807975514036ca9c09.exe	30
PID 904 wrote to memory of 436	904	13f4b7e1f2c04b807975514036ca9c09.exe	30
PID 904 wrote to memory of 436	904	13f4b7e1f2c04b807975514036ca9c09.exe	30

C:\Users\Admin\AppData\Local\Temp\13f4b7e1f2c04b807975514036ca9c09.exe
"C:\Users\Admin\AppData\Local\Temp\13f4b7e1f2c04b807975514036ca9c09.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\13f4b7e1f2c04b807975514036ca9c09.exe
  "{path}"
  2⤵
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-22-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/436-27-0x0000000006110000-0x0000000006111000-memory.dmp

Download

memory/436-51-0x0000000006330000-0x0000000006331000-memory.dmp

Download

memory/436-50-0x0000000006320000-0x0000000006321000-memory.dmp

Download

memory/436-36-0x0000000005630000-0x0000000005631000-memory.dmp

Download

memory/436-35-0x00000000062A0000-0x00000000062A1000-memory.dmp

Download

memory/436-28-0x00000000061D0000-0x00000000061D1000-memory.dmp

Download

memory/436-15-0x0000000074D20000-0x000000007540E000-memory.dmp

Download

memory/436-19-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/436-17-0x00000000048E0000-0x00000000048E1000-memory.dmp

Download

memory/436-18-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/436-16-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/904-11-0x0000000074D20000-0x000000007540E000-memory.dmp

Download

memory/904-10-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/904-9-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/904-7-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1696-3-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/1696-2-0x0000000074D20000-0x000000007540E000-memory.dmp

Download

memory/1696-6-0x0000000004460000-0x00000000044A2000-memory.dmp

Download

memory/1696-5-0x0000000000560000-0x000000000056E000-memory.dmp

Download