Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 20:15
Static task
static1
General
-
Target
ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe
-
Size
342KB
-
MD5
680f717ad65a351559fd678bbe7318fb
-
SHA1
fd5aa89b668eed10b58890caedaf5ae0f0dd5c52
-
SHA256
ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9
-
SHA512
02c21e30c1c0e3e2449c0611baafb04af1c1c9273ee7e831a4cfbc53a11c3ac65ad3feb8b732e8c1db3fba9f7e79c607f6ec279003ecfb7fa5dcc927337d0e99
-
SSDEEP
3072:C1qb6bq3ALHBERGx4dsuTofP7YK4SXtLgEN4VcFaXk+KrEKkBwruQjiMTE5kafZi:CoRwLh7xaK40UE6V4a4rEK5ruQj9bah
Malware Config
Signatures
-
Processes:
ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe -
Processes:
ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4144 5108 WerFault.exe ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exepid process 5108 ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe 5108 ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exedescription pid process Token: SeDebugPrivilege 5108 ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe"C:\Users\Admin\AppData\Local\Temp\ea71bb62482bb375c517988a0fe8688c962d6fe90761a3b43216466315d40ae9.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 9242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5108 -ip 51081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5108-132-0x0000000004C70000-0x0000000005214000-memory.dmpFilesize
5.6MB
-
memory/5108-133-0x000000000074E000-0x000000000076E000-memory.dmpFilesize
128KB
-
memory/5108-135-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/5108-134-0x00000000020D0000-0x00000000020FD000-memory.dmpFilesize
180KB
-
memory/5108-136-0x000000000074E000-0x000000000076E000-memory.dmpFilesize
128KB
-
memory/5108-137-0x000000000074E000-0x000000000076E000-memory.dmpFilesize
128KB
-
memory/5108-138-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB