f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
Size

12KB
MD5

5652113ad4a46a22e7ccd27b4b0e249b
SHA1

391ae3fe7a1be33fcf0799d803c88888d4033ebe
SHA256

f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633
SHA512

af0215de9876de7af1c484b90c4ca68efcfa06db2af9fc82f9ec5f73fec4e5b6755db677719fe6c389566a885d3b09638f98b9f4e8e554bfba758a3b6949fd97
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
2028	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe

C:\Users\Admin\AppData\Local\Temp\f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe
"C:\Users\Admin\AppData\Local\Temp\f55347cc9b0940e0a6ed3a11d002656d7f5bfdb6c517385361fe87c147604633.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-133-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

Filesize
40KB

Download