4f5eab20ce89ca95f447e6d9215e389d87de0837e444ffd6505e67d681ea77f7

Analysis

max time kernel
7s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 15:34

Target

299ecd188ad0ca3be20f245bc720969f.exe
Size

6KB
MD5

299ecd188ad0ca3be20f245bc720969f
SHA1

754b5202b9ed40335b6239527e0f0fae62e5f7ab
SHA256

4f5eab20ce89ca95f447e6d9215e389d87de0837e444ffd6505e67d681ea77f7
SHA512

951bfb24d11abbb6e7930fb3d0f6b9e5ef87fd3508f207f970f30962fc622304ef5556140e7f21501c96f4fe44a337d7d21629e792be457aa7376f6f7b5a3ff3
SSDEEP

96:JUvu8PNpQHrsbwOrWnuVE7zgI4XUIi9qxZSf8ejA+s1e3/IESWsKuF:JUvu8PN+3OrJWOVwf8ek+We3/IrWTuF

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\kernels64.exe"	299ecd188ad0ca3be20f245bc720969f.exe

Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2196 netsh.exe

pid	process
2196	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\system32\\kernels64.exe"	299ecd188ad0ca3be20f245bc720969f.exe

Drops file in System32 directory 2 IoCs

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\kernels64.exe	299ecd188ad0ca3be20f245bc720969f.exe
File created	C:\Windows\SysWOW64\kernels64.exe	299ecd188ad0ca3be20f245bc720969f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

pid process

1720 299ecd188ad0ca3be20f245bc720969f.exe

pid	process
1720	299ecd188ad0ca3be20f245bc720969f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	pid	process	target process
PID 1720 wrote to memory of 2196	1720	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe
PID 1720 wrote to memory of 2196	1720	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe
PID 1720 wrote to memory of 2196	1720	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe
PID 1720 wrote to memory of 2196	1720	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\299ecd188ad0ca3be20f245bc720969f.exe
"C:\Users\Admin\AppData\Local\Temp\299ecd188ad0ca3be20f245bc720969f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set allowedprogram C:\Users\Admin\AppData\Local\Temp\299ecd188ad0ca3be20f245bc720969f.exe enable
  2⤵
  - Modifies Windows Firewall
  PID:2196