faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91

Analysis

max time kernel
153s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe
Size

925KB
MD5

5bf757b62ee654ad58118227ffc8ef5d
SHA1

81f0a4c130ec7ac0fc61a40856c20ce0e3f0b1bf
SHA256

faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91
SHA512

d17e8b3c10a613a9af5a04e901862bf179dab8320895ee94ad1a9ac6d06b7378d2ee7dca8bc95f5489aaaff328632b24055cf1c13723fb19eb356d910ba2ed9c

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	powershell.exe
5028	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 5028	2008	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe	89
PID 2008 wrote to memory of 5028	2008	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe	89
PID 2008 wrote to memory of 5028	2008	faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe	89

C:\Users\Admin\AppData\Local\Temp\faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe
"C:\Users\Admin\AppData\Local\Temp\faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-130-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download
memory/2008-131-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download
memory/5028-133-0x0000000002570000-0x00000000025A6000-memory.dmp

Filesize
216KB

Download
memory/5028-134-0x0000000004F60000-0x0000000005588000-memory.dmp

Filesize
6.2MB

Download
memory/5028-135-0x0000000004D50000-0x0000000004D72000-memory.dmp

Filesize
136KB

Download
memory/5028-136-0x0000000004EF0000-0x0000000004F56000-memory.dmp

Filesize
408KB

Download
memory/5028-137-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/5028-138-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/5028-139-0x00000000063B0000-0x00000000063E2000-memory.dmp

Filesize
200KB

Download
memory/5028-140-0x000000006F240000-0x000000006F28C000-memory.dmp

Filesize
304KB

Download
memory/5028-141-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/5028-142-0x0000000007830000-0x0000000007EAA000-memory.dmp

Filesize
6.5MB

Download
memory/5028-143-0x00000000071B0000-0x00000000071CA000-memory.dmp

Filesize
104KB

Download
memory/5028-144-0x00000000064C0000-0x00000000064CA000-memory.dmp

Filesize
40KB

Download
memory/5028-145-0x0000000007410000-0x00000000074A6000-memory.dmp

Filesize
600KB

Download
memory/5028-146-0x00000000009A0000-0x00000000009AE000-memory.dmp

Filesize
56KB

Download
memory/5028-147-0x00000000071F0000-0x000000000720A000-memory.dmp

Filesize
104KB

Download