Analysis
-
max time kernel
90s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 00:05
Static task
static1
General
-
Target
7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe
-
Size
341KB
-
MD5
eda3f5f110201416bf3532dec93929d7
-
SHA1
30fe3bbc11037a01b825b39b3c5c67c3bd8022ce
-
SHA256
7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376
-
SHA512
2f71707c01e056d201f997504a508d0378133562d04101d2d1d73910633ece51c1abd32d36b86aee5c0a61dd1ff712d26b367fffd6ff8d2d6a5abaaa66863eaa
-
SSDEEP
3072:CT0b6bkmL6wRGYrjtiEqZtkJaEmDHaMG8uBpr6xu456a47yIdjl90j8AuQjiMTEC:CAzmL63mjtiTfHaM7u+yGfuQj9za3
Malware Config
Signatures
-
Processes:
7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe -
Processes:
7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exepid process 848 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe 848 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exedescription pid process Token: SeDebugPrivilege 848 7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe"C:\Users\Admin\AppData\Local\Temp\7a5f6bfeda0bb3d4a1dc8209fd480375dfaa2077f2180cd25a7ee8d053fe9376.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-132-0x0000000004C70000-0x0000000005214000-memory.dmpFilesize
5.6MB
-
memory/848-133-0x000000000072E000-0x000000000074E000-memory.dmpFilesize
128KB
-
memory/848-134-0x00000000020F0000-0x000000000211D000-memory.dmpFilesize
180KB
-
memory/848-135-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/848-136-0x000000000072E000-0x000000000074E000-memory.dmpFilesize
128KB
-
memory/848-137-0x000000000072E000-0x000000000074E000-memory.dmpFilesize
128KB
-
memory/848-138-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB