Resubmissions
30-05-2024 08:19
240530-j76t7acf66 1030-05-2024 08:16
240530-j6cjyscf33 1030-05-2024 08:10
240530-j244eabe3t 1030-05-2024 07:54
240530-jrx74scc37 10Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 08:16
Behavioral task
behavioral1
Sample
Growtoken.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
General
-
Target
Growtoken.exe
-
Size
1.2MB
-
MD5
b4fd82d36033b222e24a3bebb36160c2
-
SHA1
f0834b6a9fe196eff0df953a8054f0cc16d31b5e
-
SHA256
d44006982388af1f774550e394ebc9a613bbccd2e0dbedfdac871fee1872ad96
-
SHA512
3bc7a33310105b1a3a882e7e407de49bdb11cf8d8360d4b56d2908fc3b8d075cecb2d198803a78cde132432efd9920ebfd3ebdb3c9dd1d7dd4f3061103240b74
-
SSDEEP
12288:XTEYAsROAsrt/uxduo1jB0Y96qlBBScaepDkNDFTK/6AHR2MZ/Rev0HMpHqEc:XwT7rC6qpScJpMuSCR1ZevuEqE
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1088-1-0x0000000000940000-0x0000000000A4E000-memory.dmp disable_win_def -
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral1/memory/1088-1-0x0000000000940000-0x0000000000A4E000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Growtoken.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Growtoken.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Growtoken.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Growtoken.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growtoken.exe Growtoken.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growtoken.exe Growtoken.exe -
Executes dropped EXE 1 IoCs
pid Process 2892 dcd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features Growtoken.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 2804 powershell.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1088 Growtoken.exe Token: SeDebugPrivilege 3044 taskmgr.exe Token: SeDebugPrivilege 2804 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe 3044 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2892 1088 Growtoken.exe 29 PID 1088 wrote to memory of 2892 1088 Growtoken.exe 29 PID 1088 wrote to memory of 2892 1088 Growtoken.exe 29 PID 1088 wrote to memory of 2892 1088 Growtoken.exe 29 PID 1088 wrote to memory of 2804 1088 Growtoken.exe 30 PID 1088 wrote to memory of 2804 1088 Growtoken.exe 30 PID 1088 wrote to memory of 2804 1088 Growtoken.exe 30 PID 1088 wrote to memory of 2508 1088 Growtoken.exe 32 PID 1088 wrote to memory of 2508 1088 Growtoken.exe 32 PID 1088 wrote to memory of 2508 1088 Growtoken.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
PID:2892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1088 -s 15562⤵PID:2508
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5b5ac46e446cead89892628f30a253a06
SHA1f4ad1044a7f77a1b02155c3a355a1bb4177076ca
SHA256def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
SHA512bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87