Analysis

  • max time kernel
    3s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 13:51

General

  • Target

    f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe

  • Size

    3MB

  • MD5

    d8553d002a6764dc4995da92cb51fa2b

  • SHA1

    b5746050922832f0eab74bea5dda43357af139b1

  • SHA256

    f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9

  • SHA512

    2417a348a6de672724b94406063138bbc17c23f7181c48bf4a5d02322723df28a48a751a130077125d8ceb5985a1da6729b196070e064a8a5251c44f5dceb8c6

Score
8/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe
    "C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe"
    1⤵
      PID:1156
      • C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe
        "C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe"
        2⤵
          PID:792
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
              PID:1924
        • C:\Windows\system32\makecab.exe
          "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220524161032.log C:\Windows\Logs\CBS\CbsPersist_20220524161032.cab
          1⤵
            PID:1520
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
            1⤵
              PID:768

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Modify Existing Service

            1
            T1031

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/768-60-0x0000000000000000-mapping.dmp
            • memory/768-61-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp
              Filesize

              8KB

            • memory/792-58-0x00000000047A0000-0x0000000004B46000-memory.dmp
              Filesize

              3MB

            • memory/792-62-0x00000000047A0000-0x0000000004B46000-memory.dmp
              Filesize

              3MB

            • memory/792-63-0x0000000000400000-0x0000000002FBF000-memory.dmp
              Filesize

              43MB

            • memory/1156-54-0x0000000004960000-0x0000000004D06000-memory.dmp
              Filesize

              3MB

            • memory/1156-55-0x0000000004960000-0x0000000004D06000-memory.dmp
              Filesize

              3MB

            • memory/1156-56-0x0000000004D10000-0x0000000005405000-memory.dmp
              Filesize

              6MB

            • memory/1156-57-0x0000000000400000-0x0000000002FBF000-memory.dmp
              Filesize

              43MB

            • memory/1924-59-0x0000000000000000-mapping.dmp