7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035

Analysis

max time kernel
114s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe
Size

132KB
MD5

96405e722413fc0e34d9b30bda2d4a6c
SHA1

9f0882cf0e5007d2d7d746061df3502210dcad6d
SHA256

7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035
SHA512

5d1b432848acdcf5f01b6564013ed468978a914e6ccbed065bd0453ee3bce47f51c3f03ddf83af21bbcb2c40a4edd214f834cf4f7d68402f24b146cbbf585397
SSDEEP

3072:jmBAi7GlmafuH3K7RpoTPcQjLTjvDHILsX9GUYAbM1O5T9j4VHf1:KiiK/Wb7jvWpU01454f

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4728	ntfyapp.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1584	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntfyapp = "C:\\Windows\\ntfyapp.exe"	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ntfyapp.config	ntfyapp.exe
File created	C:\Windows\ntfyapp.exe	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe
File opened for modification	C:\Windows\ntfyapp.exe	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe
File created	C:\Windows\ntfyapp.config	ntfyapp.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5072	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	78
PID 4284 wrote to memory of 5072	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	78
PID 4284 wrote to memory of 5072	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	78
PID 4284 wrote to memory of 5060	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	79
PID 4284 wrote to memory of 5060	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	79
PID 4284 wrote to memory of 5060	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	79
PID 4284 wrote to memory of 4728	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	80
PID 4284 wrote to memory of 4728	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	80
PID 4284 wrote to memory of 4728	4284	7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe	80
PID 4728 wrote to memory of 1584	4728	ntfyapp.exe	83
PID 4728 wrote to memory of 1584	4728	ntfyapp.exe	83
PID 4728 wrote to memory of 1584	4728	ntfyapp.exe	83
PID 5060 wrote to memory of 4628	5060	w32tm.exe	86
PID 5060 wrote to memory of 4628	5060	w32tm.exe	86
PID 5072 wrote to memory of 3644	5072	w32tm.exe	85
PID 5072 wrote to memory of 3644	5072	w32tm.exe	85

C:\Users\Admin\AppData\Local\Temp\7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe
"C:\Users\Admin\AppData\Local\Temp\7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\w32tm.exe
  w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\w32tm.exe
    w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
    3⤵
    PID:3644
- C:\Windows\SysWOW64\w32tm.exe
  w32tm /config /update
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\w32tm.exe
    w32tm /config /update
    3⤵
    PID:4628
- C:\Windows\ntfyapp.exe
  "C:\Windows\ntfyapp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set allowedprogram "C:\Windows\ntfyapp.exe" enable
    3⤵
    - Modifies Windows Firewall
    PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ntfyapp.exe

Filesize
132KB

MD5
96405e722413fc0e34d9b30bda2d4a6c

SHA1
9f0882cf0e5007d2d7d746061df3502210dcad6d

SHA256
7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035

SHA512
5d1b432848acdcf5f01b6564013ed468978a914e6ccbed065bd0453ee3bce47f51c3f03ddf83af21bbcb2c40a4edd214f834cf4f7d68402f24b146cbbf585397

Download Submit
C:\Windows\ntfyapp.exe

Filesize
132KB

MD5
96405e722413fc0e34d9b30bda2d4a6c

SHA1
9f0882cf0e5007d2d7d746061df3502210dcad6d

SHA256
7fffd306cf1ced8cb31d2c792f26d824a44d272cfc53c0781abec0a404cc4035

SHA512
5d1b432848acdcf5f01b6564013ed468978a914e6ccbed065bd0453ee3bce47f51c3f03ddf83af21bbcb2c40a4edd214f834cf4f7d68402f24b146cbbf585397

Download Submit
memory/4284-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4284-133-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4284-142-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download