dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365

Analysis

max time kernel
61s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2023 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
Size

13KB
MD5

d7b9c528a0d1b847ca4017f474b42667
SHA1

07051ef4c02dcda9b99d440c44d6fca1d6b5aaa7
SHA256

dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365
SHA512

516e687a5b4fd65cc3dcd579a7230f42ca0d5fa55288a3729802106e05eb907620a71e6f0d59a9a3b95b671cb8d63b609f97d932eac9a55a85978c960a6d3939
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
2924	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe

C:\Users\Admin\AppData\Local\Temp\dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe
"C:\Users\Admin\AppData\Local\Temp\dedf3762eea3c2e78456ae4859a028e32e9e525dd634e7901ca4003074bd4365.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-133-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download