6c174114cc8159ea4a8614b5418fa6e6405c42c64675657f69b1ae1839dd0a70

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dis_defender.exe
Size

12KB
MD5

5e4319826d24eacce3ca0738885722f3
SHA1

f028af3df311cb2d94511c8f05fa7f1efa5268b3
SHA256

6c174114cc8159ea4a8614b5418fa6e6405c42c64675657f69b1ae1839dd0a70
SHA512

f189de4fcc8e3b7ae689b06e8b881d977b15bfe69c6cc762800e3fa2cf929fe16beabee781730f5a1ec10bb61e416afb086332f71178dd9eccc6b87cd53bc0f2
SSDEEP

384:oMsJTP+6OFyf/o0xPSzbbVxu2mnj1jPGUc5tuTpqKi3hC4:oMsJTP+6OFy3LhIbbxafc5tuTpqKYhJ

Score

10^/10

evasion trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1464-0-0x0000000000A30000-0x0000000000A38000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	dis_defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	dis_defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	dis_defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	dis_defender.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	dis_defender.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1584	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1584	1464	dis_defender.exe	28
PID 1464 wrote to memory of 1584	1464	dis_defender.exe	28
PID 1464 wrote to memory of 1584	1464	dis_defender.exe	28

C:\Users\Admin\AppData\Local\Temp\dis_defender.exe
"C:\Users\Admin\AppData\Local\Temp\dis_defender.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-0-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/1464-1-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1464-13-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1584-6-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/1584-7-0x0000000002830000-0x0000000002838000-memory.dmp

Filesize
32KB

Download
memory/1584-8-0x000007FEF24C0000-0x000007FEF2E5D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-9-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1584-10-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/1584-11-0x000007FEF24C0000-0x000007FEF2E5D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-12-0x000007FEF24C0000-0x000007FEF2E5D000-memory.dmp

Filesize
9.6MB

Download