7de519f83fe48681a7c17c868c8d9c7db533904b54b48517218de458ba15d842

Analysis

max time kernel
123s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

276c48503f698413f7366d9728b78ddf.exe
Size

159KB
MD5

276c48503f698413f7366d9728b78ddf
SHA1

9b48ee94af79d37ce11e60069e114940bfadabc0
SHA256

7de519f83fe48681a7c17c868c8d9c7db533904b54b48517218de458ba15d842
SHA512

2a57b017abfb1d9d9d407f50c07a76524b3b1d0b1fe252faa15981416d725c107af394d4b2424c6c86cede93a55cc45f84d399e832b40472d069062121cf7077
SSDEEP

3072:IXbYCtTUzUxIsAQihedBZF9U+5JWu7l5Tk:4UCtTUzNsHdBZ95J/l6

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2968	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2116	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Branding\explorer.exe	276c48503f698413f7366d9728b78ddf.exe
File opened for modification	C:\Windows\Branding\explorer.exe	276c48503f698413f7366d9728b78ddf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe
2204	276c48503f698413f7366d9728b78ddf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2968	2204	276c48503f698413f7366d9728b78ddf.exe	30
PID 2204 wrote to memory of 2968	2204	276c48503f698413f7366d9728b78ddf.exe	30
PID 2204 wrote to memory of 2968	2204	276c48503f698413f7366d9728b78ddf.exe	30
PID 2204 wrote to memory of 2968	2204	276c48503f698413f7366d9728b78ddf.exe	30
PID 2204 wrote to memory of 2116	2204	276c48503f698413f7366d9728b78ddf.exe	32
PID 2204 wrote to memory of 2116	2204	276c48503f698413f7366d9728b78ddf.exe	32
PID 2204 wrote to memory of 2116	2204	276c48503f698413f7366d9728b78ddf.exe	32
PID 2204 wrote to memory of 2116	2204	276c48503f698413f7366d9728b78ddf.exe	32

C:\Users\Admin\AppData\Local\Temp\276c48503f698413f7366d9728b78ddf.exe
"C:\Users\Admin\AppData\Local\Temp\276c48503f698413f7366d9728b78ddf.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set allowedprogram program = "C:\Windows\Branding\explorer.exe" name = "Explorer" mode = ENABLE scope = ALL profile = ALL
  2⤵
  - Modifies Windows Firewall
  PID:2968
- C:\Windows\Branding\explorer.exe
  "C:\Windows\Branding\explorer.exe" C:\noexistfile.txt
  2⤵
  - Executes dropped EXE
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Branding\explorer.exe

Filesize
159KB

MD5
276c48503f698413f7366d9728b78ddf

SHA1
9b48ee94af79d37ce11e60069e114940bfadabc0

SHA256
7de519f83fe48681a7c17c868c8d9c7db533904b54b48517218de458ba15d842

SHA512
2a57b017abfb1d9d9d407f50c07a76524b3b1d0b1fe252faa15981416d725c107af394d4b2424c6c86cede93a55cc45f84d399e832b40472d069062121cf7077

Download Submit
memory/2116-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2204-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2204-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2204-9-0x0000000001FF0000-0x0000000002018000-memory.dmp

Filesize
160KB

Download