c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56

General

Target

c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe
Size

76KB
MD5

3599b17790073f51a758d8f5bf57ef68
SHA1

93e044b9adf042d19228640113fa9382a965a4cf
SHA256

c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56
SHA512

22b5900d14e337c04e3bf171680949e711e72531ce9c76be422595a9ac3ae2981f4fc4f32418ad8ae6a9cb5577ca7a75d8379317f0ef9c2c05fabd7eb62167c3

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1336-54-0x0000000000DC0000-0x0000000000DD8000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

884 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 884 powershell.exe

pid	process
884	powershell.exe

description	pid	process
Token: SeDebugPrivilege	884	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe

description	pid	process	target process
PID 1336 wrote to memory of 884	1336	c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe	powershell.exe
PID 1336 wrote to memory of 884	1336	c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe	powershell.exe
PID 1336 wrote to memory of 884	1336	c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe
"C:\Users\Admin\AppData\Local\Temp\c9e4fd95c8b123d74b69bbf7384c6957e8b90d74f585d35dc6ec20ba5d1c3d56.exe"
1⤵
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-55-0x0000000000000000-mapping.dmp

Download
memory/884-56-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/884-57-0x000007FEEDAA0000-0x000007FEEE4C3000-memory.dmp

Filesize
10.1MB

Download
memory/884-59-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/884-58-0x000007FEECF40000-0x000007FEEDA9D000-memory.dmp

Filesize
11.4MB

Download
memory/884-60-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/884-61-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/1336-54-0x0000000000DC0000-0x0000000000DD8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads