4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe
Size

100KB
MD5

ffd328a800cfc6f8a70e0d744a1edf5a
SHA1

90e23b2a82e75d5beeddf7507245a4d48fe12be2
SHA256

4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594
SHA512

2cf2beeaabe2b160b4dccce5c6aa1dcea7e20bb16574cc5a41f6931964df9579975f140c70281c63e616a401cc31a2eb7659d01e955ca869c2967f48c8b624ba
SSDEEP

1536:5p6kFya9c7Ok/YNQTSgB75eGFri7jyXX9di2YTHLYjzDm:TVBQz1ri7jyHxYTHcj/

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 4520	4244	4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	4244	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	AppLaunch.exe
4520	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4520	4244	4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe	84
PID 4244 wrote to memory of 4520	4244	4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe	84
PID 4244 wrote to memory of 4520	4244	4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe	84
PID 4244 wrote to memory of 4520	4244	4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe	84
PID 4244 wrote to memory of 4520	4244	4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe	84

C:\Users\Admin\AppData\Local\Temp\4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe
"C:\Users\Admin\AppData\Local\Temp\4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 148
  2⤵
  - Program crash
  PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4244 -ip 4244
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4520-134-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download