19422cd310419c2884cc79a1b6abfcd7816a7decaaad7407ecaf27a209d149f0

Analysis

max time kernel
71s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10/07/2023, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19422cd310419c2884cc79a1b6abfcd7816a7decaaad7.exe
Size

538KB
MD5

7cab780a8f24d381d4fa6836237983bf
SHA1

2e2eb93799eb883593d9d8f910f415d8aa55bb08
SHA256

19422cd310419c2884cc79a1b6abfcd7816a7decaaad7407ecaf27a209d149f0
SHA512

0be2be3088ccaff19f5cd26a71025d74c8c830a77eb852d726c313bcf56dd129e01273f1d2036318fc02847240cdbdf3a0a823c1752899020ce6b5f0ff38188e
SSDEEP

12288:vegHqsz47HBakwxUW2u9YhfjWP+4bOQHHhif:bKm47H3wxPFTb9g

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"

Executes dropped EXE 1 IoCs

pid
2372

Loads dropped DLL 4 IoCs

pid
3032
2304
2304
2372

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid
3032
3032

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid
Token: SeDebugPrivilege	3032

Suspicious use of WriteProcessMemory 7 IoCs

description	pid
PID 2304 wrote to memory of 2372	2304
PID 2304 wrote to memory of 2372	2304
PID 2304 wrote to memory of 2372	2304
PID 2304 wrote to memory of 2372	2304
PID 2304 wrote to memory of 2372	2304
PID 2304 wrote to memory of 2372	2304
PID 2304 wrote to memory of 2372	2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-103-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download