Resubmissions
30/05/2024, 08:19
240530-j76t7acf661030/05/2024, 08:16
240530-j6cjyscf331030/05/2024, 08:10
240530-j244eabe3t1030/05/2024, 07:54
240530-jrx74scc3710Analysis
- max time kernel
46s - max time network
33s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 08:16
Behavioral task
behavioral1
Sample
Growtoken.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
General
- Target Growtoken.exe
- Size 1.2MB
- Sample240530-j6cjyscf33
- SHA256 d44006982388af1f774550e394ebc9a613bbccd2e0dbedfdac871fee1872ad96
- MD5 b4fd82d36033b222e24a3bebb36160c2
- SHA1 f0834b6a9fe196eff0df953a8054f0cc16d31b5e
- SHA512 3bc7a33310105b1a3a882e7e407de49bdb11cf8d8360d4b56d2908fc3b8d075cecb2d198803a78cde132432efd9920ebfd3ebdb3c9dd1d7dd4f3061103240b74
- SSDEEP 12288:XTEYAsROAsrt/uxduo1jB0Y96qlBBScaepDkNDFTK/6AHR2MZ/Rev0HMpHqEc:XwT7rC6qpScJpMuSCR1ZevuEqE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/2284-1-0x00000000000B0000-0x00000000001BE000-memory.dmp disable_win_def - Detects Eternity stealer 1 IoCs
resource yara_rule behavioral2/memory/2284-1-0x00000000000B0000-0x00000000001BE000-memory.dmp eternity_stealer - Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Growtoken.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Growtoken.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Growtoken.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Growtoken.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growtoken.exe Growtoken.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Growtoken.exe Growtoken.exe - Executes dropped EXE 1 IoCs
pid Process 2356 dcd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Growtoken.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 4252 powershell.exe 4252 powershell.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2284 Growtoken.exe Token: SeDebugPrivilege 1292 taskmgr.exe Token: SeSystemProfilePrivilege 1292 taskmgr.exe Token: SeCreateGlobalPrivilege 1292 taskmgr.exe Token: SeDebugPrivilege 4252 powershell.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe 1292 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2356 2284 Growtoken.exe 84 PID 2284 wrote to memory of 2356 2284 Growtoken.exe 84 PID 2284 wrote to memory of 2356 2284 Growtoken.exe 84 PID 2284 wrote to memory of 4252 2284 Growtoken.exe 91 PID 2284 wrote to memory of 4252 2284 Growtoken.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
PID:2356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1292
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1048
-
C:\Windows\System32\t4pfwd.exe"C:\Windows\System32\t4pfwd.exe"1⤵PID:3264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w5ojlwq5.e5u.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dcd.exe
- Size 227KB
- SHA256 def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
- MD5 b5ac46e446cead89892628f30a253a06
- SHA1 f4ad1044a7f77a1b02155c3a355a1bb4177076ca
- SHA512 bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87
- SSDEEP 6144:JTZm1VVYv4sROAsrt/xxXDfs/xeeJuo1jB1imUFsAOV16q:JTEYAsROAsrt/uxduo1jB0Y96q
- MD5 SHA1 SHA512 SSDEEP