51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2023, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
Size

11KB
MD5

9df0c5537dd09f4a8b1eb5f8f6110de5
SHA1

b6626c8d88e9f65c629502d45b0ef127f1e442bb
SHA256

51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898
SHA512

a48554a5cc6724c02277b6682a68e1ed4a9fd9ba6e15f49ce0e0347a8bb2142cb99cce0eebe852d480591c125d166e661a7253f81c957b1208d2e0deef5e15c9
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
4248	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe

C:\Users\Admin\AppData\Local\Temp\51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe
"C:\Users\Admin\AppData\Local\Temp\51091875b1da3394ff86761a222413f8f57464e1ebc3f15f2112c99a25236898.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4248-133-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download