f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a

Analysis

max time kernel
48s
max time network
60s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
08-06-2023 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
Size

13KB
MD5

3d84b6caaab4fad44a5c81cb748e1411
SHA1

941be4c7a46e23d4ce56f6016053f79f8c31b508
SHA256

f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a
SHA512

d6120c8b6ecac67c04bea41bd2c01d05c0424c9a664468c236f37fae8eb84540e1c213d9a42e280c6a400e355c181d92b7aacac73930905a0f8415b3fc1238ad
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

pid	process
4340	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
4340	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

description pid process

Token: SeDebugPrivilege 4340 f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

description	pid	process
Token: SeDebugPrivilege	4340	f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe

C:\Users\Admin\AppData\Local\Temp\f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe
"C:\Users\Admin\AppData\Local\Temp\f759085a0fff30daad23216f766527b015e15220daef848c1fc95bb59fd4b11a.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4340-121-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download