4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d

Analysis

max time kernel
319s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Size

525KB
MD5

36829b878d6572aebf31a1cb5fe211c0
SHA1

944c3bda7b0bdab77f0c14267c8dd40f4995b778
SHA256

4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d
SHA512

955ad1dd9f6e5a759adfcb019e4b300ef8d9a9c99f26cfaa5c6fd23a808acf28e820fdfd4989c3f940753101952eba76ff308a8ce66122099a73f161dbf8fe11
SSDEEP

12288:3HnhriZnGv7HORqLOLunx1sI9nnRkMu+cXaj63NW892VGD:Xl0nGrZRx6anRkMn2VA89C0

Score

10^/10

evasion trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Security Center\svc	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\svc	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
4692	4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe

C:\Users\Admin\AppData\Local\Temp\4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe
"C:\Users\Admin\AppData\Local\Temp\4bb70ef6b5714eb5faa371f8d31d13729e781a2325ee2496d2ed504bc8741d0d.exe"
1⤵
- Windows security bypass
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:4692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4692-132-0x0000000000400000-0x0000000002426000-memory.dmp

Filesize
32.1MB

Download
memory/4692-133-0x0000000000400000-0x0000000002426000-memory.dmp

Filesize
32.1MB

Download
memory/4692-134-0x0000000000400000-0x0000000002426000-memory.dmp

Filesize
32.1MB

Download
memory/4692-135-0x0000000002470000-0x0000000002473000-memory.dmp

Filesize
12KB

Download
memory/4692-136-0x0000000000400000-0x0000000002426000-memory.dmp

Filesize
32.1MB

Download