Resubmissions
21/11/2022, 17:27
221121-v1q1yaba771021/11/2022, 17:23
221121-vx68raba291021/11/2022, 17:21
221121-vxfe2aah7910Analysis
- max time kernel
11s - max time network
17s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
21/11/2022, 17:21
General
- Target 9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe
- Size 136KB
- Sample221121-vxfe2aah79
- SHA256 9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe"C:\Users\Admin\AppData\Local\Temp\9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd.exe"1⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2500-117-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-118-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-119-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-120-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-121-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-122-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-123-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-124-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-125-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-126-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-127-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-128-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-129-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-130-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-131-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-132-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-133-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-134-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-135-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-136-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-137-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-138-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-139-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-140-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-141-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-142-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-143-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-144-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-145-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-146-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-147-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-148-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-149-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-150-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-152-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-151-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-153-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-154-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-155-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-156-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-157-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-158-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-159-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-160-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-161-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-162-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-163-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-164-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-165-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-166-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-167-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-172-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-174-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-175-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-176-0x0000000077580000-0x000000007770E000-memory.dmp
memory/2500-179-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-169-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-170-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-173-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-177-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-178-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-180-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-181-0x0000000077580000-0x000000007770E000-memory.dmp
memory/4916-171-0x0000000077580000-0x000000007770E000-memory.dmp