Analysis
-
max time kernel
49s -
max time network
51s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
16/06/2023, 01:31
Static task
static1
General
-
Target
6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe
-
Size
94KB
-
MD5
9622d210d537fc5ccd573cd0afca2228
-
SHA1
8b663ac93deb6875e3d53eeb6b7095aa692dcb85
-
SHA256
6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8
-
SHA512
5f676c5c058a5b7e62bd0cdc878ccef52e71b9cbe8c4635004c522307612d01f4741fc31e81e2055bc4453ec4a3ded9618e9c4bb50a8cdff4e293ed22cd881c2
-
SSDEEP
1536:/SFQTsYGgZA3ZpfEkNZMcjtMZpvPVnVIzClcXcKbuPx6:/CwsY61ZMcuvPVnVI+x
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1996 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe 1996 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1996 6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe"C:\Users\Admin\AppData\Local\Temp\6f3bb8aa7bc5bad3a29c65f3e978a255fc79e8531d04d5d1aef7e4b052c1ebf8.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996