Analysis
-
max time kernel
3s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 13:51
Static task
static1
Behavioral task
behavioral1
Sample
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe
Resource
win7-20220414-en
General
-
Target
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe
-
Size
3MB
-
MD5
d8553d002a6764dc4995da92cb51fa2b
-
SHA1
b5746050922832f0eab74bea5dda43357af139b1
-
SHA256
f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9
-
SHA512
2417a348a6de672724b94406063138bbc17c23f7181c48bf4a5d02322723df28a48a751a130077125d8ceb5985a1da6729b196070e064a8a5251c44f5dceb8c6
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe"C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe"C:\Users\Admin\AppData\Local\Temp\f4cdfcbde404bf0b59fe0f7a0738fbc9d8bac3d5b2402478e6f00ca13b40cbd9.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220524161032.log C:\Windows\Logs\CBS\CbsPersist_20220524161032.cab1⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-60-0x0000000000000000-mapping.dmp
-
memory/768-61-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmpFilesize
8KB
-
memory/792-58-0x00000000047A0000-0x0000000004B46000-memory.dmpFilesize
3MB
-
memory/792-62-0x00000000047A0000-0x0000000004B46000-memory.dmpFilesize
3MB
-
memory/792-63-0x0000000000400000-0x0000000002FBF000-memory.dmpFilesize
43MB
-
memory/1156-54-0x0000000004960000-0x0000000004D06000-memory.dmpFilesize
3MB
-
memory/1156-55-0x0000000004960000-0x0000000004D06000-memory.dmpFilesize
3MB
-
memory/1156-56-0x0000000004D10000-0x0000000005405000-memory.dmpFilesize
6MB
-
memory/1156-57-0x0000000000400000-0x0000000002FBF000-memory.dmpFilesize
43MB
-
memory/1924-59-0x0000000000000000-mapping.dmp