f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653

Analysis

max time kernel
144s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
08-06-2023 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe
Size

121KB
MD5

dff0dfcba5ac39b806886e501888e06f
SHA1

105197672ef026ee4923a2b59610575a9e174ee5
SHA256

f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653
SHA512

e261a05ed279bbdd6c3803934ef31dfabf4a642953e169da064ee205675d6c6676cccf08cb3d86055693aa2c984457da554a8cee6df6914e458155503dc38927
SSDEEP

3072:f9QLdsON8xxwaTq29LJbdYLfWvt8oyhuWVFrag1shbgrtvx:1QLvN8VT1dxWVFmZhsrt

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe

description	pid	process	target process
PID 1064 set thread context of 2412	1064	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3756 1064 WerFault.exe f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2412 AppLaunch.exe
2412 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2412 AppLaunch.exe

pid	pid_target	process	target process
3756	1064	WerFault.exe	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe

pid	process
2412	AppLaunch.exe
2412	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2412	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe

description	pid	process	target process
PID 1064 wrote to memory of 2412	1064	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe	AppLaunch.exe
PID 1064 wrote to memory of 2412	1064	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe	AppLaunch.exe
PID 1064 wrote to memory of 2412	1064	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe	AppLaunch.exe
PID 1064 wrote to memory of 2412	1064	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe	AppLaunch.exe
PID 1064 wrote to memory of 2412	1064	f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe
"C:\Users\Admin\AppData\Local\Temp\f2268c6af3b4108bdf27c8ec2c12ee9ef869e51215aa9c6c0b4d1ff9761f1653.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 140
2⤵
- Program crash
PID:3756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-118-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download