9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469

Analysis

max time kernel
53s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
Size

12KB
MD5

470dbaa3cf785482cca1f29f1524c5e4
SHA1

3fd9b09d62ba929f6c52a4f17f57bdb98ee38aec
SHA256

9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469
SHA512

366d9b2e174072a67c0b96b14b5d8f3e22549869f7b9d5bb6bd54b71ce40e42f8a6c212502edcd965ef1cb8191b4e49a375e158a18921c4a60cf98543e00cda9
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
4464	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe

C:\Users\Admin\AppData\Local\Temp\9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe
"C:\Users\Admin\AppData\Local\Temp\9d8589f03dae9c9db4ddd9d91db93f73fd445bb187b64d9605ad5afe269e2469.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4464-133-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download