d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f

Analysis

max time kernel
128s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe
Size

28KB
MD5

21a1328793e1f61d5e5da52d2bbbf0f0
SHA1

b535d5d4f6a8e3f415be439da8a7259911250f5d
SHA256

d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f
SHA512

362e448d4c99e3342111f2243751dd95eefd2c7b043d7b7c37103af2b3fc9e029c4c03c5fec557eced12359867e0210a35afbe4751d9d4c4c290c58c7563b22d
SSDEEP

768:qaM2n1o+Cm14tuq8LJeNeJC+5iudM8X2AEBrx:5M21f140qU5i9N9N

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3152	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Windows\\system32\\winds32.exe"	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winds32.exe	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe
File opened for modification	C:\Windows\SysWOW64\winds32.exe	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe
File opened for modification	C:\Windows\SysWOW64\dflgh8jkd2q8.exe	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3152	4952	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe	81
PID 4952 wrote to memory of 3152	4952	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe	81
PID 4952 wrote to memory of 3152	4952	d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe	81

C:\Users\Admin\AppData\Local\Temp\d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe
"C:\Users\Admin\AppData\Local\Temp\d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set allowedprogram 'C:\Users\Admin\AppData\Local\Temp\d2c45fb0814de0faaba6b39a0e5ef18707d7d4bc43db85fcf2eb8e6529dd483f.exe' enable
  2⤵
  - Modifies Windows Firewall
  PID:3152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4952-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4952-134-0x0000000000480000-0x0000000000485000-memory.dmp

Filesize
20KB

Download
memory/4952-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download