81c2b5f2a62e986e81acd68ff5cce838a08be7f5feebd5c1a09ea81db8b3077a

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/04/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debloat-Windows-10-master/scripts/disable-windows-defender.ps1
Size 2KB
Sample240403-db43tseb49
SHA256 27365de295c362797d14cc90311549f5d67f8a76dc981e374648ac51752017b0
MD5 b745b1a0b4b70e44fac3b25abdb3f63e
SHA1 ce16a432c63df3be945af976b43a06d5454c3f12
SHA512 19454c7dfdf1c2fd8aa8a7d1fec9f35e26288e6e36f90d78b4a94759db4fb56f64bc91cc63f1e696bd3c6eb949ffc2733410143184896b46af37da7b7fdbf933
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeTakeOwnershipPrivilege	2132	powershell.exe
Token: SeIncreaseQuotaPrivilege	2132	powershell.exe
Token: SeSecurityPrivilege	2132	powershell.exe
Token: SeTakeOwnershipPrivilege	2132	powershell.exe
Token: SeLoadDriverPrivilege	2132	powershell.exe
Token: SeSystemProfilePrivilege	2132	powershell.exe
Token: SeSystemtimePrivilege	2132	powershell.exe
Token: SeProfSingleProcessPrivilege	2132	powershell.exe
Token: SeIncBasePriorityPrivilege	2132	powershell.exe
Token: SeCreatePagefilePrivilege	2132	powershell.exe
Token: SeBackupPrivilege	2132	powershell.exe
Token: SeRestorePrivilege	2132	powershell.exe
Token: SeShutdownPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeSystemEnvironmentPrivilege	2132	powershell.exe
Token: SeRemoteShutdownPrivilege	2132	powershell.exe
Token: SeUndockPrivilege	2132	powershell.exe
Token: SeManageVolumePrivilege	2132	powershell.exe
Token: 33	2132	powershell.exe
Token: 34	2132	powershell.exe
Token: 35	2132	powershell.exe
Token: 36	2132	powershell.exe
Token: SeIncreaseQuotaPrivilege	2132	powershell.exe
Token: SeSecurityPrivilege	2132	powershell.exe
Token: SeTakeOwnershipPrivilege	2132	powershell.exe
Token: SeLoadDriverPrivilege	2132	powershell.exe
Token: SeSystemProfilePrivilege	2132	powershell.exe
Token: SeSystemtimePrivilege	2132	powershell.exe
Token: SeProfSingleProcessPrivilege	2132	powershell.exe
Token: SeIncBasePriorityPrivilege	2132	powershell.exe
Token: SeCreatePagefilePrivilege	2132	powershell.exe
Token: SeBackupPrivilege	2132	powershell.exe
Token: SeRestorePrivilege	2132	powershell.exe
Token: SeShutdownPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeSystemEnvironmentPrivilege	2132	powershell.exe
Token: SeRemoteShutdownPrivilege	2132	powershell.exe
Token: SeUndockPrivilege	2132	powershell.exe
Token: SeManageVolumePrivilege	2132	powershell.exe
Token: 33	2132	powershell.exe
Token: 34	2132	powershell.exe
Token: 35	2132	powershell.exe
Token: 36	2132	powershell.exe
Token: SeIncreaseQuotaPrivilege	2132	powershell.exe
Token: SeSecurityPrivilege	2132	powershell.exe
Token: SeTakeOwnershipPrivilege	2132	powershell.exe
Token: SeLoadDriverPrivilege	2132	powershell.exe
Token: SeSystemProfilePrivilege	2132	powershell.exe
Token: SeSystemtimePrivilege	2132	powershell.exe
Token: SeProfSingleProcessPrivilege	2132	powershell.exe
Token: SeIncBasePriorityPrivilege	2132	powershell.exe
Token: SeCreatePagefilePrivilege	2132	powershell.exe
Token: SeBackupPrivilege	2132	powershell.exe
Token: SeRestorePrivilege	2132	powershell.exe
Token: SeShutdownPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeSystemEnvironmentPrivilege	2132	powershell.exe
Token: SeRemoteShutdownPrivilege	2132	powershell.exe
Token: SeUndockPrivilege	2132	powershell.exe
Token: SeManageVolumePrivilege	2132	powershell.exe
Token: 33	2132	powershell.exe
Token: 34	2132	powershell.exe
Token: 35	2132	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1416	2132	powershell.exe	88
PID 2132 wrote to memory of 1416	2132	powershell.exe	88
PID 1416 wrote to memory of 2392	1416	csc.exe	91
PID 1416 wrote to memory of 2392	1416	csc.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Debloat-Windows-10-master\scripts\disable-windows-defender.ps1
1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hvng0rs0\hvng0rs0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F2C.tmp" "c:\Users\Admin\AppData\Local\Temp\hvng0rs0\CSC5EE5235A4B8A4C39A1789DFE92F435B1.TMP"
    3⤵
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3F2C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3F2C.tmp
Size 1KB
SHA256 39e805b5970c714a19b97d273059f4ad68686959f29120a834dd93fad742c8e6
MD5 91cdfc84430e05c8fc4e8def02291e34
SHA1 fe034e637db3e12850f6801bbb93de5b2c669f4d
SHA512 2b9cefffe27f163e7ee23e7c5449ddc2dcb19a20ca777ff20d642aeae19e715db88c28375d372c7dab42ec4d72638076bd76c04fec08d5fbf4d70300592d7cc3
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dliwzzs4.t2x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dliwzzs4.t2x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

hvng0rs0.dll

Path C:\Users\Admin\AppData\Local\Temp\hvng0rs0\hvng0rs0.dll
Size 4KB
SHA256 61aa3c7c166da453cd90ba7f13824770853ef803c1cf0a4f84e43766078c2248
MD5 6758142d9ded1b0154a577388a4b10be
SHA1 0b3644621395c985eeac6b72a8604896c14cba5f
SHA512 e7b42823f8abf05637189aba8b9f62d54a67ca43f1316fb15b67320887e25dc8d425a60599278c64b35d2fd64447b1b747f10897208729522b76d273dc6d86f5
MD5 SHA1 SHA512

Submit Download

CSC5EE5235A4B8A4C39A1789DFE92F435B1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hvng0rs0\CSC5EE5235A4B8A4C39A1789DFE92F435B1.TMP
Size 652B
SHA256 97e1217aca97816e64ec3543fc8cca574f7cae59409abb5bad2bc93b133a4418
MD5 ee1035f056da82d2d5d011fbd21c32bc
SHA1 7505ced8723906839420a24f94713c8641e7636f
SHA512 6096043c9a6475f358ed06f0f98179d6e3202863a8f242b2ef403b93e9e190899b183b62f7b881ebd77742e6b7f8b4e30b4bc8f813ecb4d552b252f6910013e0
MD5 SHA1 SHA512

Submit Download

hvng0rs0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hvng0rs0\hvng0rs0.0.cs
Size 1KB
SHA256 1b91a79cc350ae51efc192bcacfa2d5110d6ea1cecbe911e4f29dccf1c552c23
MD5 db8b1abe547d28cf7dbba64fb49d0c70
SHA1 7d0717c3340dcfc3aaa448f4dd3616eb49c5c1b3
SHA512 a387507dc2ab813e80954c18c08a2c1b3bd2c5fa40bdaa91002b66e03fc734f1ace19a52bfa2b7d994816f78ca4c3e42265c4aecd37323ae878b0c8d73c355cf
MD5 SHA1 SHA512

Submit Download

hvng0rs0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hvng0rs0\hvng0rs0.cmdline
Size 369B
SHA256 440248a38308142d7681a2c6b8b2f8b5595eeae26ea9d7f68a0be0dae9c52c0e
MD5 a62c0477e9ceae38d5f0d4990c7a3e87
SHA1 41e91a3ae258de64683ccdf3265d1bef984a66ee
SHA512 2bffa68789dc425d44d12bdece24c67df68b9d9f33f570a7354ab3961909bc398456294e7f4e65bfd25ad41af4d99ed875624c2412702c42fb7c8d01be818854
MD5 SHA1 SHA512

Submit Download

memory/2132-10-0x0000023CB58B0000-0x0000023CB58D2000-memory.dmp

Download

memory/2132-13-0x0000023CB58A0000-0x0000023CB58B0000-memory.dmp

Download

memory/2132-15-0x0000023CCDF80000-0x0000023CCE082000-memory.dmp

Download

memory/2132-14-0x0000023CB58A0000-0x0000023CB58B0000-memory.dmp

Download

memory/2132-0-0x0000023CCDCE0000-0x0000023CCDD62000-memory.dmp

Download

memory/2132-12-0x00007FFB04BB0000-0x00007FFB05671000-memory.dmp

Download

memory/2132-28-0x0000023CB57A0000-0x0000023CB57A8000-memory.dmp

Download

memory/2132-11-0x0000023CB5790000-0x0000023CB57A0000-memory.dmp

Download

memory/2132-30-0x0000023CCDE70000-0x0000023CCDEBA000-memory.dmp

Download

memory/2132-31-0x0000023CB58A0000-0x0000023CB58B0000-memory.dmp

Download

memory/2132-32-0x0000023CCDEE0000-0x0000023CCDEFE000-memory.dmp

Download

memory/2132-33-0x0000023CB58A0000-0x0000023CB58B0000-memory.dmp

Download

memory/2132-36-0x00007FFB04BB0000-0x00007FFB05671000-memory.dmp

Download