Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 01:18

General

  • Target

    Product/Disable defender/dfControl.exe

  • Size

    445KB

  • MD5

    10d8e4ca3fa2902859c77f41baee4dda

  • SHA1

    2421ff6f2cfc1aa807eb5781b2980a6e493b31d0

  • SHA256

    20c730c7033b5bdc0a6510825e90449ba8f87942d2d7f61fa1ba5f100e98c141

  • SHA512

    e89ecee14b949725878f14dbb0ef908f5741fd2d8298052d5522c84650ce0e6bdaac66278029b90f9da1acd0815abbdbd9f90ccf9b08966433723557d54e4aed

  • SSDEEP

    12288:Jzcf7EanlQ0YZL8cf9eMUiwfEo7FnmGUGJ:Zcf7NELUhfEo7xmdGJ

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 18 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.exe
    "C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.exe
      "C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.exe
        "C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.exe" /TI
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2500
  • C:\Windows\system32\makecab.exe
    "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240617011826.log C:\Windows\Logs\CBS\CbsPersist_20240617011826.cab
    1⤵
    • Drops file in Windows directory
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Product\Disable defender\dfControl.ini

    Filesize

    2KB

    MD5

    59b35cd913ed1888c71616c541c150cb

    SHA1

    c709835c96c69e42ab9d592c6e447bf4d6688783

    SHA256

    18a6c46004844e40b692a8454d66a8f7615927b15be432c0de21ad622d0c7abc

    SHA512

    cd4e068c3d6bc9abdd2f77176fc47bc986bcb67e3d82b17ea60f82403995e75fb6a9da0d2e2f1eac81017189ffb92fd0f8ab49e71b6dee34b9cb6a777835196b

  • C:\Windows\Temp\aut1084.tmp

    Filesize

    15KB

    MD5

    93e42daecb6275f7fc49a8f5b12a7edf

    SHA1

    0b4b037fcd2997249197bafb53cfa3489321c320

    SHA256

    3dcc465363e157b36198a5f8649f57b0f5fa950287ea4959903e637a0cd8a79a

    SHA512

    cde18c402ae8253ab1024f55ede24877198f6cec8016e5fdcb4dea09406f2d8db97e8065a9db1a97d5eab67c5b2dde296be109d415d37838c5cf2f066351f534

  • C:\Windows\Temp\aut1095.tmp

    Filesize

    12KB

    MD5

    7a8207b501b20a0ef6b7f631b40e3bdf

    SHA1

    b36194c3346ad5ab0e6683ae9676d15bf47c8915

    SHA256

    eac3ceafe46b52057b7f370e7290dd0905c50c2ce772b76e3fab3886fc6b3dd1

    SHA512

    11a92c47b2f1943f73ea48547a04c52e441ffc51cc61f2d8a6306d51e6daf08b5aaa23ddf11358056ed5971984344bb4bbbf6670acebc9103091972719429200

  • C:\Windows\Temp\aut1096.tmp

    Filesize

    7KB

    MD5

    a0ab548853aafd090db3c6aae10f6b5e

    SHA1

    f3d5a95d4fcc8f496d88c35522d2ca2285f5ff4a

    SHA256

    8faf739b926d56fb5125041c8bee45289c86127a10dfb68fb9df8d58360c3542

    SHA512

    9bbfc18283039191336752112fc638c7dae1f6a2f33f6c79bdd807e33c266abd4e92b90506ffea6286376a3571829309f8969af837bf0619fba863ba57c53753

  • C:\Windows\Temp\lkjvrxit.tmp

    Filesize

    38KB

    MD5

    83a150055998174d5c89b2e9986df7f2

    SHA1

    e0ac99307939ee444db125961c44293805cb979e

    SHA256

    3473b86565efb6e0126b0da8366ddd7b6447ef0a30dbe0676672485f38cf485b

    SHA512

    fb163df3046affdca1695312be1f05062dec68e93be55e39d4112f03cfdea401ea72e204ad0a69557f4e070498e911b44daf3525220af8e0a0bb5049024345ee

  • memory/2500-109-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-111-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-120-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-46-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-119-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-96-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-108-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-118-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-110-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-117-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-112-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-113-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-114-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-115-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2500-116-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2548-0-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2548-22-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2612-45-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2612-41-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB