3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2023 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Size

238KB
MD5

d25ca078eeee62ce1bd8cf530fdced1b
SHA1

99e411725a2fc6a1db65ea2da8cd728b5b80e1cd
SHA256

3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636
SHA512

bb800274c9f59c369d6cf778a78c82f8f691b3ec64b83ff8e0e044f2d0ce8d81d9f659065156df7943ae8505320bdbcc36227082433db7a7c5e936526ae77035
SSDEEP

3072:Qlhp+mhJ9/K5e596a83HJCxIi4ZFysh72U4QuOUD+HXA+hrGfskO70yV4l4RTte:M//Jhl597cCx9TsF2kxUUXVJGfsr9FT

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3500	4216	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4216	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
4216	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe

C:\Users\Admin\AppData\Local\Temp\3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe
"C:\Users\Admin\AppData\Local\Temp\3357f16666e8769322b4fd7234f169c90183a593062f9d9db504b620902d5636.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 960
  2⤵
  - Program crash
  PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4216 -ip 4216
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4216-132-0x000000000093E000-0x000000000095E000-memory.dmp

Filesize
128KB

Download
memory/4216-133-0x00000000024D0000-0x00000000024FD000-memory.dmp

Filesize
180KB

Download
memory/4216-134-0x0000000000400000-0x0000000000798000-memory.dmp

Filesize
3.6MB

Download
memory/4216-135-0x000000000093E000-0x000000000095E000-memory.dmp

Filesize
128KB

Download
memory/4216-136-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/4216-137-0x000000000093E000-0x000000000095E000-memory.dmp

Filesize
128KB

Download
memory/4216-138-0x0000000000400000-0x0000000000798000-memory.dmp

Filesize
3.6MB

Download