Analysis
-
max time kernel
5s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6.exe
-
Size
3.8MB
-
MD5
4a000400f17b48589a88c179e6a1d77b
-
SHA1
2d589c7e3787c5390d453813422f5f12b8dda608
-
SHA256
cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6
-
SHA512
60b5efa71e7b7c610ca8d5584ac587659a5bd1109f8a972ab43e7f1ca98a4a10d70d47b243988c3a38cbe42b01dea5ebd702ac7ff0ca7636cf9a99086b192cbc
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6.exe"C:\Users\Admin\AppData\Local\Temp\cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6.exe"C:\Users\Admin\AppData\Local\Temp\cdbc70a5bce6d5c7c10882f2d84d899385fe2833b40dba200917926c66ff34c6.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220524154518.log C:\Windows\Logs\CBS\CbsPersist_20220524154518.cab1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-61-0x0000000000000000-mapping.dmp
-
memory/1056-58-0x0000000002230000-0x00000000025D6000-memory.dmpFilesize
3.6MB
-
memory/1056-59-0x0000000002230000-0x00000000025D6000-memory.dmpFilesize
3.6MB
-
memory/1056-60-0x0000000000400000-0x0000000001E38000-memory.dmpFilesize
26.2MB
-
memory/1720-54-0x0000000002190000-0x0000000002536000-memory.dmpFilesize
3.6MB
-
memory/1720-55-0x0000000002190000-0x0000000002536000-memory.dmpFilesize
3.6MB
-
memory/1720-56-0x0000000002540000-0x0000000002C35000-memory.dmpFilesize
7.0MB
-
memory/1720-57-0x0000000000400000-0x0000000001E38000-memory.dmpFilesize
26.2MB
-
memory/1984-62-0x0000000000000000-mapping.dmp