c02cc70910e23e082cf3320a67d145c5bf3e30ebd39b9547c608b089cb6a1f38

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/05/2023, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

k8707326.exe
Size

177KB
MD5

c311684968f23749455a0236b9df03bd
SHA1

caa9eca212b97fadd55864d9dc2ad7d2882d5349
SHA256

c02cc70910e23e082cf3320a67d145c5bf3e30ebd39b9547c608b089cb6a1f38
SHA512

33f9d37aba40ef2d17ef11431aac0c8301e1647976527eeada41d13af89cf3f8172142cae5e1e692a4d3c57b4011cd53f18aeb38c49b7d769e787f0746c58afb
SSDEEP

3072:pDKW1LgppLRHMY0TBfJvjcTp5XZpa8nqeo7Qbeues6Y:pDKW1Lgbdl0TBBvjc/S81Sues

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	k8707326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	k8707326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	k8707326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	k8707326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	k8707326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	k8707326.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	k8707326.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	k8707326.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1408	k8707326.exe
1408	k8707326.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	k8707326.exe

C:\Users\Admin\AppData\Local\Temp\k8707326.exe
"C:\Users\Admin\AppData\Local\Temp\k8707326.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-54-0x0000000000510000-0x000000000052A000-memory.dmp

Filesize
104KB

Download
memory/1408-55-0x0000000000540000-0x0000000000558000-memory.dmp

Filesize
96KB

Download
memory/1408-56-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-57-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-59-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-61-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-63-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-65-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-69-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-67-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-71-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-75-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-73-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-79-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-77-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-81-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-83-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1408-84-0x0000000002130000-0x0000000002170000-memory.dmp

Filesize
256KB

Download