000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb

Analysis

max time kernel
74s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
Size

11KB
MD5

745780a05e9025c6c3694ba01d543a92
SHA1

40ffe53a550d1dad4c2f2c41703d07998aed540c
SHA256

000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb
SHA512

395857d034ad2489a014070a453f340a8bfef56307f5426f6d746c3e7264e900d659045b29a2f98957eabff2223f04fa3e3e74342c757e683bfb4e4d340a278f
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
2600	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe

C:\Users\Admin\AppData\Local\Temp\000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe
"C:\Users\Admin\AppData\Local\Temp\000281454f5a284b3416e9c5599f4680cbacd0f10a6feb2bbd17acffab672beb.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-133-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download