Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 19:48
Behavioral task
behavioral1
Sample
23099521fdf04fd9729aa2e5d5cb593b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
23099521fdf04fd9729aa2e5d5cb593b.exe
Resource
win10v2004-20231215-en
General
-
Target
23099521fdf04fd9729aa2e5d5cb593b.exe
-
Size
2.9MB
-
MD5
23099521fdf04fd9729aa2e5d5cb593b
-
SHA1
a4e8dc7105a881e8df79457dba9ac88e3d6ee001
-
SHA256
3e00ed3b1e47b4eac2b15cea7023b21804144558d052133b847e92b75c8afd93
-
SHA512
c513438b8a68f8eb07449291ec38e92db937ea3e3dd78b7c61a5a97c4c31ee8f975c0b17621d86544cc3aa3ed149b3d11cd0e7afe9028271dbc396f4ab2a44ce
-
SSDEEP
49152:yBO0my9ash+6Yt2RU/mWxc4Tlo2iZOen7Xy/RuEIqjufVAqPCyLx35L:wO0b1YsRUDa4kZp7MRu1qjSGqPpNJL
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/3040-0-0x00000000013B0000-0x000000000169E000-memory.dmp disable_win_def behavioral1/memory/3040-2-0x0000000004ED0000-0x0000000004F10000-memory.dmp disable_win_def