c687022a880d9bdb2070dfdea36b9932d118a4038fc79814a81208a9c3b75dca

Analysis

max time kernel
293s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2023, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sw07Ch26yc34.exe
Size

14KB
MD5

6a36d38d28c42d1c12cbd996f07e6406
SHA1

9df102592ffaebbead4c5a6474cdbfaa662fd019
SHA256

c687022a880d9bdb2070dfdea36b9932d118a4038fc79814a81208a9c3b75dca
SHA512

56b44f4f1bd5cf3c125d48f633febb4c13929b42aebf228d8744206405452baa030cd6b0ab1ee9fe262b3a11d170c47d5d940b4b7f88ad8247cbb758ad6a7400
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sw07Ch26yc34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sw07Ch26yc34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sw07Ch26yc34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sw07Ch26yc34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sw07Ch26yc34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sw07Ch26yc34.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sw07Ch26yc34.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
956	sw07Ch26yc34.exe
956	sw07Ch26yc34.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	sw07Ch26yc34.exe

C:\Users\Admin\AppData\Local\Temp\sw07Ch26yc34.exe
"C:\Users\Admin\AppData\Local\Temp\sw07Ch26yc34.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-133-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download