1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1

Analysis

max time kernel
118s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe
Size

121KB
MD5

b285167c58f7d2f93baf84fa0db2f9ac
SHA1

1ed45f37d05f35f9c27f8ee01ad9c05c1b79938b
SHA256

1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1
SHA512

1bd71dde37bdad0de5ec4989d3a03e760cd81476b8f05d7750efe695eb940f3b4b6cca914aebe653a9e944b7723b206017505c71db08322e607594cd29581264
SSDEEP

3072:U9QLdsON8xxwaTq29LzGZZLfWvm8oyhuWVFrag1shb4rtvx:mQLvN8VTGZ1WVFmZhcrt

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 708	4316	1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4332	4316	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
708	AppLaunch.exe
708	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 708	4316	1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe	86
PID 4316 wrote to memory of 708	4316	1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe	86
PID 4316 wrote to memory of 708	4316	1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe	86
PID 4316 wrote to memory of 708	4316	1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe	86
PID 4316 wrote to memory of 708	4316	1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe	86

C:\Users\Admin\AppData\Local\Temp\1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe
"C:\Users\Admin\AppData\Local\Temp\1efe09234891a78e8e7fc05f491429390bfcc38c8fa631f978bb9f4dc04196d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 156
  2⤵
  - Program crash
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4316 -ip 4316
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/708-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download