f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d

Analysis

max time kernel
76s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
Size

12KB
MD5

b8b29a3f69d5b08b873bb59f2bf4453c
SHA1

6bebea790f503c4401a731e2faff883ba272d841
SHA256

f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d
SHA512

e440eee2ec9fb0422e8bd8d240db76f6faa16789b19ff3544df5bfd8823132423893cd4593e8e2730b9bb9fbbf7bf357382a9a07492b44b64367deb186362e5e
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
2560	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe

C:\Users\Admin\AppData\Local\Temp\f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe
"C:\Users\Admin\AppData\Local\Temp\f6cbf40999b12dbbb3f4eb617a47f28454c8b13f74fdcd9dcb6f20df347cb39d.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-133-0x0000000000DB0000-0x0000000000DBA000-memory.dmp

Filesize
40KB

Download