Analysis
- max time kernel
49s - max time network
114s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/08/2021, 15:12
General
- Target 6439889cfd410e3b57422781c93e26cf.exe
- Size 455KB
- Sample210805-8rc6ee2pga
- SHA256 c58ec23d6e9d1f548d0d9375009bf23ebfb9f40eb9bb14fccc4e10f385f53d5d
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6439889cfd410e3b57422781c93e26cf.exe"C:\Users\Admin\AppData\Local\Temp\6439889cfd410e3b57422781c93e26cf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6439889cfd410e3b57422781c93e26cf.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6439889cfd410e3b57422781c93e26cf.exe"{path}"2⤵
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/776-121-0x0000000004AD0000-0x0000000004AD2000-memory.dmp
memory/776-117-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/776-118-0x00000000075A0000-0x00000000075A1000-memory.dmp
memory/776-119-0x0000000005060000-0x0000000005061000-memory.dmp
memory/776-120-0x0000000007640000-0x0000000007641000-memory.dmp
memory/776-114-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/776-122-0x0000000005220000-0x0000000005221000-memory.dmp
memory/776-123-0x00000000050F0000-0x0000000005162000-memory.dmp
memory/776-124-0x0000000005080000-0x000000000509F000-memory.dmp
memory/776-116-0x0000000004FB0000-0x0000000005010000-memory.dmp
memory/1176-125-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1740-135-0x0000000006D30000-0x0000000006D31000-memory.dmp
memory/1740-141-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/1740-134-0x0000000006D80000-0x0000000006D81000-memory.dmp
memory/1740-136-0x0000000007420000-0x0000000007421000-memory.dmp
memory/1740-137-0x0000000007490000-0x0000000007491000-memory.dmp
memory/1740-138-0x0000000007670000-0x0000000007671000-memory.dmp
memory/1740-139-0x0000000006740000-0x0000000006741000-memory.dmp
memory/1740-140-0x0000000006742000-0x0000000006743000-memory.dmp
memory/1740-133-0x0000000006640000-0x0000000006641000-memory.dmp
memory/1740-142-0x0000000007E20000-0x0000000007E21000-memory.dmp
memory/1740-143-0x0000000007E70000-0x0000000007E71000-memory.dmp
memory/1740-151-0x0000000008B90000-0x0000000008BC3000-memory.dmp
memory/1740-158-0x0000000008B70000-0x0000000008B71000-memory.dmp
memory/1740-163-0x0000000008CE0000-0x0000000008CE1000-memory.dmp
memory/1740-164-0x000000007EB60000-0x000000007EB61000-memory.dmp
memory/1740-165-0x00000000090A0000-0x00000000090A1000-memory.dmp
memory/1740-234-0x0000000006743000-0x0000000006744000-memory.dmp
memory/1740-359-0x0000000009050000-0x0000000009051000-memory.dmp
memory/1740-365-0x0000000009040000-0x0000000009041000-memory.dmp