Analysis
- max time kernel
45s - max time network
49s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
31/08/2022, 07:40
General
- Target dac8362f889dbdec8dada32d58711cca.exe
- Size 317KB
- Sample220831-jhh2tsbabl
- SHA256 72feedd4e621f3cef4b529d6d8e8547eaacc1c276dc4d1ade2fe0d3e44cfee67
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Windows security modification 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dac8362f889dbdec8dada32d58711cca.exe"C:\Users\Admin\AppData\Local\Temp\dac8362f889dbdec8dada32d58711cca.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1960-56-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp
memory/1960-57-0x000007FEF3F40000-0x000007FEF4963000-memory.dmp
memory/1960-60-0x0000000002434000-0x0000000002437000-memory.dmp
memory/1960-58-0x000007FEF33E0000-0x000007FEF3F3D000-memory.dmp
memory/1960-61-0x0000000002434000-0x0000000002437000-memory.dmp
memory/1960-62-0x000000000243B000-0x000000000245A000-memory.dmp
memory/2020-54-0x000007FEF3F40000-0x000007FEF4963000-memory.dmp
memory/2020-59-0x0000000001F56000-0x0000000001F75000-memory.dmp
memory/2020-63-0x0000000001F56000-0x0000000001F75000-memory.dmp