53aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

16KB
MD5

d7f2c50640108c104286ef71923c70d7
SHA1

7ccd84daed8ca9572ae3a8c98c38adf753fb8f33
SHA256

53aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a
SHA512

eeb34a038920d0ff833f3140afd256dd6a0ea589052223d9bf61135d4557e8302e582782893348a7d40ef07af0c68a3068a052822d244ad65b7365cd0aeea0f0
SSDEEP

384:aGDtcgI/NNcJAQ+cprMzboXyfPMexhHTQ9KQUxZ:aGDtcgI/NNcJ/+grWbrF8i

Score

10^/10

evasion trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1960-54-0x0000000001120000-0x000000000112A000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tmp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tmp.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

tmp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WinDefend\Start = "4"	tmp.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tmp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	tmp.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2040 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1684 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1684 powershell.exe

pid	process
2040	schtasks.exe

pid	process
1684	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1960 wrote to memory of 1684	1960	tmp.exe	powershell.exe
PID 1960 wrote to memory of 1684	1960	tmp.exe	powershell.exe
PID 1960 wrote to memory of 1684	1960	tmp.exe	powershell.exe
PID 1960 wrote to memory of 1684	1960	tmp.exe	powershell.exe
PID 1960 wrote to memory of 2040	1960	tmp.exe	schtasks.exe
PID 1960 wrote to memory of 2040	1960	tmp.exe	schtasks.exe
PID 1960 wrote to memory of 2040	1960	tmp.exe	schtasks.exe
PID 1960 wrote to memory of 2040	1960	tmp.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tmp.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2040

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-55-0x0000000000000000-mapping.dmp

Download
memory/1684-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1684-57-0x0000000070F50000-0x00000000714FB000-memory.dmp

Filesize
5.7MB

Download
memory/1684-58-0x0000000070F50000-0x00000000714FB000-memory.dmp

Filesize
5.7MB

Download
memory/1960-54-0x0000000001120000-0x000000000112A000-memory.dmp

Filesize
40KB

Download
memory/2040-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads