cb97e869fa64eb7c797a1b817f20d63cbd8310a26f4249c5727be2b776c98f16

General

Target

ConfigureDefender.exe
Size

2.3MB
MD5

9913d5f652dbf25d363ff3d7b5cd1fc2
SHA1

151de1e486bcf572b9334472355f3623ea10b05a
SHA256

cb97e869fa64eb7c797a1b817f20d63cbd8310a26f4249c5727be2b776c98f16
SHA512

7ca70bc1f6b75677ee1f565ca5f22be0224b47f2e7000b82a7b22c8edb0e3306c058bbb67f68ca6a403fae1b6f02d75b6b7f2f0306cc2a814ae0447c0879997b
SSDEEP

49152:XLqgyALphFVTPAb3FbfxPBfV0Esz40BOdo6dPsdjvf3xTZtVYEszl:XLqgyUplPAb3JfxZfV0EUp0PsdjX3xFa

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000600000002a995-2.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
404	ConfigureDefender_x64.exe

Loads dropped DLL 3 IoCs

pid	Process
5100	ConfigureDefender.exe
5100	ConfigureDefender.exe
5100	ConfigureDefender.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000002a995-2.dat	upx
behavioral1/memory/5100-7-0x0000000000B30000-0x0000000000B42000-memory.dmp	upx
behavioral1/memory/5100-6-0x0000000000B30000-0x0000000000B42000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000100000002a9bb-14.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1560	PowerShell.exe
1560	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
404	ConfigureDefender_x64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 404	5100	ConfigureDefender.exe	78
PID 5100 wrote to memory of 404	5100	ConfigureDefender.exe	78
PID 404 wrote to memory of 1560	404	ConfigureDefender_x64.exe	80
PID 404 wrote to memory of 1560	404	ConfigureDefender_x64.exe	80

C:\Users\Admin\AppData\Local\Temp\ConfigureDefender.exe
"C:\Users\Admin\AppData\Local\Temp\ConfigureDefender.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe
  "C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP'; New-ItemProperty -Path $path -Name 'PreferencesTest' -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey('EnableNetworkProtection'); SetRegistryKey( 'EnableControlledFolderAccess');SetRegistryKey('DisableRealtimeMonitoring'); SetRegistryKey('DisableBehaviorMonitoring'); SetRegistryKey('DisableBlockAtFirstSeen'); SetRegistryKey('MAPSReporting');SetRegistryKey('SubmitSamplesConsent');SetRegistryKey('DisableIOAVProtection'); SetRegistryKey('DisableScriptScanning'); SetRegistryKey('PUAProtection'); SetRegistryKey('ScanAvgCPULoadFactor');
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mx43fhc.com.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4150.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4150.tmp\nsRandom.dll

Filesize
21KB

MD5
ab467b8dfaa660a0f0e5b26e28af5735

SHA1
596abd2c31eaff3479edf2069db1c155b59ce74d

SHA256
db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

SHA512
7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

Download Submit
C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe

Filesize
1.8MB

MD5
0f8ee39a0e3662205aa268c9a44f694f

SHA1
56271747a560ae2f2af08bd5fafd3e404baf21c2

SHA256
5b431d9be209a84b0e6c366bb676956c5e2b6a6b8d9d525a062b1931f4f30aad

SHA512
a43249ef57533c2f509470775a82729a3de9f06ce8d22571afb1e7057c7560880e13c967d16f74a5b430d41d6289c98b382afcb89a3e839b1788de24af826a76

Download Submit
memory/1560-24-0x000001F74C440000-0x000001F74C462000-memory.dmp

Filesize
136KB

Download
memory/1560-25-0x00007FFB53380000-0x00007FFB53E42000-memory.dmp

Filesize
10.8MB

Download
memory/1560-28-0x000001F732540000-0x000001F732550000-memory.dmp

Filesize
64KB

Download
memory/1560-27-0x000001F732540000-0x000001F732550000-memory.dmp

Filesize
64KB

Download
memory/1560-26-0x000001F732540000-0x000001F732550000-memory.dmp

Filesize
64KB

Download
memory/1560-30-0x00007FFB53380000-0x00007FFB53E42000-memory.dmp

Filesize
10.8MB

Download
memory/5100-7-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download
memory/5100-6-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing