ca4071b32d81b7e15183a89246053b64731408d41fa26412e5709b9bc94fd4e1

Analysis

max time kernel
130s
max time network
146s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 01:51

Target

adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Size

773KB
MD5

987d0f92ed9871031e0061e16e7bbac4
SHA1

b69f3badc82b6da0ff311f9dc509bac244464332
SHA256

adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440
SHA512

f4ecf0bd996fd9aab99eba225bed9dbe2af3f8857a32bc9f0eda2c2fe8b468f5f853e68e96c029cf4cfd161409e072777db92a7502b58b541e0057b449f79770
SSDEEP

24576:guuhBzW6ZEaA9WipcnEsbsX0GMeVTwLWKEq:1gzJG6EVT+Wlq

Score

10^/10

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb98685d3d6a8fa5e90b6fd9d458601d874718d5815f8aab66728ba9d067440.exe