Analysis

  • max time kernel
    3s
  • max time network
    4s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-12-2024 09:32

Errors

Reason
Machine shutdown

General

  • Target

    c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe

  • Size

    87KB

  • MD5

    d6d956267a268c9dcf48445629d2803e

  • SHA1

    cc0feae505dad9c140dd21d1b40b518d8e61b3a4

  • SHA256

    c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850

  • SHA512

    e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee

  • SSDEEP

    1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe
    "C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security modification
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\system32\reg.exe
      "reg.exe" delete HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend /f
      2⤵
      • Impair Defenses: Safe Mode Boot
      • Modifies registry key
      PID:588
    • C:\Windows\system32\bcdedit.exe
      "bcdedit.exe" /set {default} safeboot network
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:2004
    • C:\Windows\system32\reg.exe
      "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850.exe","C:\Windows\system32\userinit.exe" /f
      2⤵
      • Modifies WinLogon for persistence
      PID:700
    • C:\Windows\system32\net.exe
      "net.exe" user Admin ""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 user Admin ""
        3⤵
          PID:2760
      • C:\Windows\system32\shutdown.exe
        "shutdown.exe" /r /t 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        2⤵
          PID:2716
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0
        1⤵
          PID:2776
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x1
          1⤵
            PID:2224

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2124-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

            Filesize

            4KB

          • memory/2124-1-0x0000000000C20000-0x0000000000C3C000-memory.dmp

            Filesize

            112KB

          • memory/2124-2-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

            Filesize

            9.9MB

          • memory/2124-3-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

            Filesize

            9.9MB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.