3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1

Analysis

max time kernel
105s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe
Size

100KB
MD5

0e8f5f66fdc8f809dece1d63e3103c0e
SHA1

12c1bdf6cca073711e79e55b8e60490d1222c7de
SHA256

3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1
SHA512

6014d2192b0b8761c4d7b8e82a5850de4552686153a4abfbf7726eaaabbe969b9c6b3fe9fa8dbe0a52d66b97260be59c6da2d0166242c0b09806a44565a1b6c4
SSDEEP

1536:vp6kFya9c7Ok/YNQ9vgB75eGF6ijjyXX9di2YTHLYjzDm:hVBQG16ijjyHxYTHcj/

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 2384	2472	3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3376	2472	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2384	AppLaunch.exe
2384	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2384	2472	3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe	84
PID 2472 wrote to memory of 2384	2472	3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe	84
PID 2472 wrote to memory of 2384	2472	3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe	84
PID 2472 wrote to memory of 2384	2472	3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe	84
PID 2472 wrote to memory of 2384	2472	3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe	84

C:\Users\Admin\AppData\Local\Temp\3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe
"C:\Users\Admin\AppData\Local\Temp\3d40cf64685b25d05402cf4e5e5115133b414fef401834653529e7032630fbe1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 140
  2⤵
  - Program crash
  PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2472 -ip 2472
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-134-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download