Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:18
Static task
static1
Behavioral task
behavioral1
Sample
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe
Resource
win7-20240419-en
General
-
Target
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe
-
Size
11KB
-
MD5
ff5735fd2989c4a287ab1224205aa5f8
-
SHA1
dce12b73ab4ce77a8208f30962190defa6e7264c
-
SHA256
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5
-
SHA512
f6a3dddfffc0277be575131299dfd8f11b91e03d7e72899a99c60e98a7eed34767114b5b0b4c1bc788547657a2a5442705bb60bc828877de06e1a7d39d6d3f60
-
SSDEEP
192:BY6CytS3WGBZC3S+4TV+G99EalsDfxOCpJx3ptpJ+fl:BY6CytS3WGBg3cTE05lsDc65Q
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe -
Processes:
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe -
Processes:
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 2160 sc.exe 3248 sc.exe 1708 sc.exe 3316 sc.exe 2596 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3444 powershell.exe 3444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3444 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.execmd.execmd.exedescription pid process target process PID 4460 wrote to memory of 3080 4460 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe cmd.exe PID 4460 wrote to memory of 3080 4460 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe cmd.exe PID 4460 wrote to memory of 3080 4460 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe cmd.exe PID 4460 wrote to memory of 3036 4460 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe cmd.exe PID 4460 wrote to memory of 3036 4460 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe cmd.exe PID 4460 wrote to memory of 3036 4460 41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe cmd.exe PID 3080 wrote to memory of 3444 3080 cmd.exe powershell.exe PID 3080 wrote to memory of 3444 3080 cmd.exe powershell.exe PID 3080 wrote to memory of 3444 3080 cmd.exe powershell.exe PID 3036 wrote to memory of 3248 3036 cmd.exe sc.exe PID 3036 wrote to memory of 3248 3036 cmd.exe sc.exe PID 3036 wrote to memory of 3248 3036 cmd.exe sc.exe PID 3036 wrote to memory of 1708 3036 cmd.exe sc.exe PID 3036 wrote to memory of 1708 3036 cmd.exe sc.exe PID 3036 wrote to memory of 1708 3036 cmd.exe sc.exe PID 3036 wrote to memory of 3316 3036 cmd.exe sc.exe PID 3036 wrote to memory of 3316 3036 cmd.exe sc.exe PID 3036 wrote to memory of 3316 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2596 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2596 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2596 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2160 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2160 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2160 3036 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe"C:\Users\Admin\AppData\Local\Temp\41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe"1⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:userprofile2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:userprofile3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc stop BITS3⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10lg1ldx.kp2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3444-20-0x0000000006890000-0x00000000068C2000-memory.dmpFilesize
200KB
-
memory/3444-5-0x0000000005A40000-0x0000000005A62000-memory.dmpFilesize
136KB
-
memory/3444-21-0x00000000703E0000-0x000000007042C000-memory.dmpFilesize
304KB
-
memory/3444-3-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/3444-31-0x0000000006870000-0x000000000688E000-memory.dmpFilesize
120KB
-
memory/3444-6-0x0000000005BA0000-0x0000000005C06000-memory.dmpFilesize
408KB
-
memory/3444-1-0x0000000002CD0000-0x0000000002D06000-memory.dmpFilesize
216KB
-
memory/3444-32-0x00000000074B0000-0x0000000007553000-memory.dmpFilesize
652KB
-
memory/3444-17-0x0000000005C80000-0x0000000005FD4000-memory.dmpFilesize
3.3MB
-
memory/3444-18-0x0000000006290000-0x00000000062AE000-memory.dmpFilesize
120KB
-
memory/3444-19-0x00000000062D0000-0x000000000631C000-memory.dmpFilesize
304KB
-
memory/3444-0-0x00000000745CE000-0x00000000745CF000-memory.dmpFilesize
4KB
-
memory/3444-4-0x00000000053D0000-0x00000000059F8000-memory.dmpFilesize
6.2MB
-
memory/3444-2-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB
-
memory/3444-7-0x0000000005C10000-0x0000000005C76000-memory.dmpFilesize
408KB
-
memory/3444-34-0x00000000075C0000-0x00000000075DA000-memory.dmpFilesize
104KB
-
memory/3444-33-0x0000000007C00000-0x000000000827A000-memory.dmpFilesize
6.5MB
-
memory/3444-35-0x0000000007640000-0x000000000764A000-memory.dmpFilesize
40KB
-
memory/3444-36-0x0000000007840000-0x00000000078D6000-memory.dmpFilesize
600KB
-
memory/3444-37-0x00000000077D0000-0x00000000077E1000-memory.dmpFilesize
68KB
-
memory/3444-39-0x0000000007810000-0x0000000007824000-memory.dmpFilesize
80KB
-
memory/3444-38-0x0000000007800000-0x000000000780E000-memory.dmpFilesize
56KB
-
memory/3444-40-0x0000000007900000-0x000000000791A000-memory.dmpFilesize
104KB
-
memory/3444-41-0x00000000078E0000-0x00000000078E8000-memory.dmpFilesize
32KB
-
memory/3444-44-0x00000000745C0000-0x0000000074D70000-memory.dmpFilesize
7.7MB