Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 17:22
Static task
static1
Behavioral task
behavioral1
Sample
308d3dda1ab8a16b017aa6813053b3b2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
308d3dda1ab8a16b017aa6813053b3b2.exe
Resource
win10v2004-20231215-en
General
-
Target
308d3dda1ab8a16b017aa6813053b3b2.exe
-
Size
78KB
-
MD5
308d3dda1ab8a16b017aa6813053b3b2
-
SHA1
2599fb3bf0ae87bd9cbbe5d41dd5d55d10ac8390
-
SHA256
e26856ee8c058fbed5b35acadc7bfbe61a4bdc7b24c3e9c944adb4f953f5a109
-
SHA512
f97deea82dad7625a118d7bd4506282b74735f6f994ec05b2f896bd867da21ed92795dc13f2add01675ace92a01ec38eda4127e5621717707c051bf06b07835f
-
SSDEEP
1536:WdgF3iGc0QU87VeQ5hButGvwo/UQ4Z2ZlrS:vF3iGc0QUg32Gvj/UQ4ZqlrS
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 308d3dda1ab8a16b017aa6813053b3b2.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 308d3dda1ab8a16b017aa6813053b3b2.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 308d3dda1ab8a16b017aa6813053b3b2.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\ProgramData\wDtecwD\test123.exe = "C:\\ProgramData\\wDtecwD\\test123.exe:*:Enabled:IE" 308d3dda1ab8a16b017aa6813053b3b2.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 308d3dda1ab8a16b017aa6813053b3b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\AutoStartAgent = "0" 308d3dda1ab8a16b017aa6813053b3b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\SystemConfigurationAgent = "0" 308d3dda1ab8a16b017aa6813053b3b2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wDtec Update Client = "C:\\ProgramData\\wDtecwD\\test123.exe" 308d3dda1ab8a16b017aa6813053b3b2.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4772 5056 WerFault.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\308d3dda1ab8a16b017aa6813053b3b2.exe"C:\Users\Admin\AppData\Local\Temp\308d3dda1ab8a16b017aa6813053b3b2.exe"1⤵
- Modifies firewall policy service
- Windows security modification
- Adds Run key to start application
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 4242⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5056 -ip 50561⤵PID:3660
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1