3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d

Analysis

max time kernel
52s
max time network
73s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2023, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe
Size

100KB
MD5

cf80e4a2fa4149c3af9a130396cb4798
SHA1

3ddb474062d80d2089c2ee5eb6c2bc06aa77e3bb
SHA256

3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d
SHA512

c95e21a796351fb4a865b902bfed1f56206cf8e14c7c52dab2185c250b6e6383ce54aad11a2cba2e763a5ffd2a34795c7042e15960c21dced0e5b11685579cac
SSDEEP

1536:Rp6kFya9c7Ok/YNQmdgB75eGFKiTjyXX9di2YTHLYjzDm:bVBQmy1KiTjyHxYTHcj/

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4132 set thread context of 4856	4132	3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	4132	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	AppLaunch.exe
4856	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4856	4132	3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe	67
PID 4132 wrote to memory of 4856	4132	3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe	67
PID 4132 wrote to memory of 4856	4132	3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe	67
PID 4132 wrote to memory of 4856	4132	3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe	67
PID 4132 wrote to memory of 4856	4132	3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe	67

C:\Users\Admin\AppData\Local\Temp\3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe
"C:\Users\Admin\AppData\Local\Temp\3a3f92062fe787e3062a7942202354bd5e02a50454ae6f8048f0c199dbe1983d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 236
  2⤵
  - Program crash
  PID:64

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-117-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download