Analysis
- max time kernel
143s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
03/10/2022, 04:15
General
- Target tmp.exe
- Size 16KB
- Sample221003-evd67ahacq
- SHA256 53aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Modifies security service 2 TTPs 2 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tmp.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2040-132-0x0000000000E60000-0x0000000000E6A000-memory.dmp
memory/3952-134-0x0000000004F50000-0x0000000004F86000-memory.dmp
memory/3952-135-0x00000000055C0000-0x0000000005BE8000-memory.dmp
memory/3952-136-0x0000000005520000-0x0000000005542000-memory.dmp
memory/3952-137-0x0000000005CF0000-0x0000000005D56000-memory.dmp
memory/3952-138-0x0000000005DD0000-0x0000000005E36000-memory.dmp
memory/3952-139-0x00000000064F0000-0x000000000650E000-memory.dmp
memory/3952-140-0x0000000006AB0000-0x0000000006AE2000-memory.dmp
memory/3952-141-0x00000000707F0000-0x000000007083C000-memory.dmp
memory/3952-142-0x0000000006A90000-0x0000000006AAE000-memory.dmp
memory/3952-143-0x0000000007E40000-0x00000000084BA000-memory.dmp
memory/3952-144-0x00000000077F0000-0x000000000780A000-memory.dmp
memory/3952-145-0x0000000007860000-0x000000000786A000-memory.dmp
memory/3952-146-0x0000000007A70000-0x0000000007B06000-memory.dmp
memory/3952-147-0x0000000007A20000-0x0000000007A2E000-memory.dmp
memory/3952-148-0x0000000007B30000-0x0000000007B4A000-memory.dmp
memory/3952-149-0x0000000007B10000-0x0000000007B18000-memory.dmp