6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
Size

13KB
MD5

b4d1df44bc2a04fcdc2071f6054c5b09
SHA1

4c07635f36ea55d7207f492c56af89db48742280
SHA256

6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b
SHA512

55710af73eaef6cd40b82d301f1b0e6b950ce79aa147eeaeaf95a4af2187641118a0d57a70912cbb5dbdb6aec9a8aa9e8345ffd13a0054dc1f9fcb27ebdde7a9
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
748	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe

C:\Users\Admin\AppData\Local\Temp\6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe
"C:\Users\Admin\AppData\Local\Temp\6a479432c044dc6a35133655df9ae402ab0a282a80e96f44118e9979c418184b.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-133-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

Filesize
40KB

Download