0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
Size

13KB
MD5

b385135c441ae05fdc9e191a10ed0110
SHA1

645a1099f8aaa9901bb7e920e656bcbd147429cc
SHA256

0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc
SHA512

146f82c2b8643c3b98c1b392cb0b9442d346b6b057b5dafc568fb30c19e06e7f2fb36f3a997d74a58402255e2a03b1c8e80d6b27b2f906e1babf698ee3ed0d37
SSDEEP

96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
1436	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe

C:\Users\Admin\AppData\Local\Temp\0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe
"C:\Users\Admin\AppData\Local\Temp\0331551b2b8b0bfa9e44b0c547d97a9fcaccf8e03889ba9e6bd8e63d2fc692cc.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1436-133-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

Filesize
40KB

Download