Overview

overview

10

Static

static

10

e9407e6908...da.exe

windows7_x64

8

e9407e6908...da.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    153s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 23:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe

  • Size

    93KB

  • MD5

    6dd5a90af346912262be470471966c2c

  • SHA1

    b206b30e18d6e9a90bd00113ad2049c6c50f2874

  • SHA256

    e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da

  • SHA512

    532e0fd8e82a8e10b6f72416f884b5756de22cb71a06f4e5c7c088beedba6b1efff8207776e47a5ee6316a2692f943d392559a0d7724e380eadbf17f7c23a984

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe
    "C:\Users\Admin\AppData\Local\Temp\e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe"
    1⤵
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe" "e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe" ENABLE
      2⤵
        PID:3572
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe"
        2⤵
          PID:2496
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe" "e9407e6908c64f045476ca09a1378e31f776fef8b5237b79719c77a891dfe2da.exe" ENABLE
          2⤵
            PID:1612

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Modify Existing Service

        1
        T1031

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1612-133-0x0000000000000000-mapping.dmp
          Download
        • memory/1652-130-0x0000000074D70000-0x0000000075321000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/2496-132-0x0000000000000000-mapping.dmp
          Download
        • memory/3572-131-0x0000000000000000-mapping.dmp
          Download