6b18a825b27244eb29430637d97752e65a45cbdafeb4298f54bbbe3a096473a5

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Size

60KB
MD5

801371fcee1dbbc9a320f61cc0e7735c
SHA1

02d9219a5431aed3853e4eca1abb785d828f86cf
SHA256

9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872
SHA512

2e66a0ed94b98eb29b421c40ba4cf277fa1d6d9c88d003d86339223abf509f8ccba8e51c51ae7e18a79b317ba1d407d21d93996c5a13fdb6e6975afd7f5305bb
SSDEEP

1536:0uKzCQOYrknOD+gV5uQ+NSCFb4Pg9jH1/:UyYrknG+45wNnFrN9

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/1944-0-0x0000000000090000-0x00000000000A6000-memory.dmp	net_reactor

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
1944	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe

C:\Users\Admin\AppData\Local\Temp\9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe
"C:\Users\Admin\AppData\Local\Temp\9a5d0de937e92800af460c2ddf4ae6b04a7828ac60331c8a01ff82b780048872.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-1-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/1944-0-0x0000000000090000-0x00000000000A6000-memory.dmp

Filesize
88KB

Download
memory/1944-3-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download