9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365

Analysis

max time kernel
52s
max time network
71s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
07-06-2023 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe
Size

121KB
MD5

e6d8e5b89ceb16bcdc9600b61a0b8bfc
SHA1

2d5386c7b557812d481d2338825029d4a9850fc8
SHA256

9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365
SHA512

1192d77b73814f85b8d6f86bbc170fa44e130615da03368793c169f4b3e950833ad38230e7fb12c05b635980edef5fe889893526d6965477ee1232ff1328a779
SSDEEP

3072:R9QLdsON8xxwaTq29L2d82OLfWv38oyhuWVFrag1shbIrtvx:nQLvN8VTo8KWVFmZhcrt

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 2832	2312	9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	2312	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	AppLaunch.exe
2832	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2832	2312	9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe	67
PID 2312 wrote to memory of 2832	2312	9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe	67
PID 2312 wrote to memory of 2832	2312	9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe	67
PID 2312 wrote to memory of 2832	2312	9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe	67
PID 2312 wrote to memory of 2832	2312	9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe	67

C:\Users\Admin\AppData\Local\Temp\9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe
"C:\Users\Admin\AppData\Local\Temp\9f4cf952d8e97b0ebace19226f4a61205a25b0497a55ed7730b5fe4fc1820365.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 140
  2⤵
  - Program crash
  PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-121-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download