Analysis
- max time kernel
93s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
13/05/2023, 22:56
General
- Target pr569229.exe
- Size 278KB
- Sample230513-2wtdtscb4t
- SHA256 710e82c143a50c474bb54551ec1535e6dd2ebdb0fb7a7f66e311a87f6baacbb6
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pr569229.exe"C:\Users\Admin\AppData\Local\Temp\pr569229.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 9482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 560 -ip 5601⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-134-0x00000000047A0000-0x00000000047CD000-memory.dmp
memory/560-135-0x0000000007240000-0x00000000077E4000-memory.dmp
memory/560-136-0x0000000007230000-0x0000000007240000-memory.dmp
memory/560-137-0x0000000007230000-0x0000000007240000-memory.dmp
memory/560-138-0x0000000007230000-0x0000000007240000-memory.dmp
memory/560-140-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-139-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-142-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-144-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-146-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-148-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-150-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-152-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-154-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-156-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-158-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-160-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-162-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-164-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-166-0x0000000007800000-0x0000000007812000-memory.dmp
memory/560-167-0x0000000000400000-0x0000000002BA0000-memory.dmp
memory/560-168-0x0000000007230000-0x0000000007240000-memory.dmp
memory/560-169-0x0000000007230000-0x0000000007240000-memory.dmp
memory/560-170-0x0000000007230000-0x0000000007240000-memory.dmp
memory/560-172-0x0000000000400000-0x0000000002BA0000-memory.dmp