Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/04/2024, 04:41
Behavioral task
behavioral1
Sample
ConfigureDefender.exe
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
$_0_/ConfigureDefender_x64.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
$_0_/ConfigureDefender_x86.exe
Resource
win11-20240419-en
General
-
Target
ConfigureDefender.exe
-
Size
2.3MB
-
MD5
9913d5f652dbf25d363ff3d7b5cd1fc2
-
SHA1
151de1e486bcf572b9334472355f3623ea10b05a
-
SHA256
cb97e869fa64eb7c797a1b817f20d63cbd8310a26f4249c5727be2b776c98f16
-
SHA512
7ca70bc1f6b75677ee1f565ca5f22be0224b47f2e7000b82a7b22c8edb0e3306c058bbb67f68ca6a403fae1b6f02d75b6b7f2f0306cc2a814ae0447c0879997b
-
SSDEEP
49152:XLqgyALphFVTPAb3FbfxPBfV0Esz40BOdo6dPsdjvf3xTZtVYEszl:XLqgyUplPAb3JfxZfV0EUp0PsdjX3xFa
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000600000002a995-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 404 ConfigureDefender_x64.exe -
Loads dropped DLL 3 IoCs
pid Process 5100 ConfigureDefender.exe 5100 ConfigureDefender.exe 5100 ConfigureDefender.exe -
resource yara_rule behavioral1/files/0x000600000002a995-2.dat upx behavioral1/memory/5100-7-0x0000000000B30000-0x0000000000B42000-memory.dmp upx behavioral1/memory/5100-6-0x0000000000B30000-0x0000000000B42000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000100000002a9bb-14.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1560 PowerShell.exe 1560 PowerShell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 404 ConfigureDefender_x64.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1560 PowerShell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5100 wrote to memory of 404 5100 ConfigureDefender.exe 78 PID 5100 wrote to memory of 404 5100 ConfigureDefender.exe 78 PID 404 wrote to memory of 1560 404 ConfigureDefender_x64.exe 80 PID 404 wrote to memory of 1560 404 ConfigureDefender_x64.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\ConfigureDefender.exe"C:\Users\Admin\AppData\Local\Temp\ConfigureDefender.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe"C:\Windows\Temp\241538342459015213\0\ConfigureDefender_x64.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exeC:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP'; New-ItemProperty -Path $path -Name 'PreferencesTest' -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey('EnableNetworkProtection'); SetRegistryKey( 'EnableControlledFolderAccess');SetRegistryKey('DisableRealtimeMonitoring'); SetRegistryKey('DisableBehaviorMonitoring'); SetRegistryKey('DisableBlockAtFirstSeen'); SetRegistryKey('MAPSReporting');SetRegistryKey('SubmitSamplesConsent');SetRegistryKey('DisableIOAVProtection'); SetRegistryKey('DisableScriptScanning'); SetRegistryKey('PUAProtection'); SetRegistryKey('ScanAvgCPULoadFactor');3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
21KB
MD5ab467b8dfaa660a0f0e5b26e28af5735
SHA1596abd2c31eaff3479edf2069db1c155b59ce74d
SHA256db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
SHA5127d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
-
Filesize
1.8MB
MD50f8ee39a0e3662205aa268c9a44f694f
SHA156271747a560ae2f2af08bd5fafd3e404baf21c2
SHA2565b431d9be209a84b0e6c366bb676956c5e2b6a6b8d9d525a062b1931f4f30aad
SHA512a43249ef57533c2f509470775a82729a3de9f06ce8d22571afb1e7057c7560880e13c967d16f74a5b430d41d6289c98b382afcb89a3e839b1788de24af826a76