d677f86403915b15ab62b1278cc7e6a8f2a98de2ba6a84ee67e06c1ffd696bc1

Analysis

max time kernel
105s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Size

804KB
MD5

2389e42ff51d5ad1f896a23cf8aa846e
SHA1

a04d40e9ff1b51b0fd606b57dbe17d737c6b08c7
SHA256

d677f86403915b15ab62b1278cc7e6a8f2a98de2ba6a84ee67e06c1ffd696bc1
SHA512

27054d642ce4be6791ce49f317628371052c0992d02129cbc07128e3f1f3338631d71226b5428a713104735daedccd5c9f5aea6e17161447a9b05bb8b42d5c10
SSDEEP

24576:U/fprVmqZKA9JgLLK8ltKTrk/9efaTh6QAJ:GhMwcToQAJ

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipinfo.io
5 ipinfo.io

flow	ioc
4	ipinfo.io
5	ipinfo.io

C:\Users\Admin\AppData\Local\Temp\D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe
"C:\Users\Admin\AppData\Local\Temp\D677F86403915B15AB62B1278CC7E6A8F2A98DE2BA6A8.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
PID:4220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads