8ee76799220183625f317f176086db2c95af7099c1c0edf8dd6eff3711c4ad4f

Analysis

max time kernel
0s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d15e6c18de827e82a8020e1c6475ba8.exe
Size

123KB
MD5

3d15e6c18de827e82a8020e1c6475ba8
SHA1

4cac5c1f282875a7b3026b76c63eaea9bd71ce7d
SHA256

8ee76799220183625f317f176086db2c95af7099c1c0edf8dd6eff3711c4ad4f
SHA512

e600a8d516dccf91877853fffca0208d789f8972ebe2992eba65b57269cc4351e90687f5f6b1035305f7d9163eca6cfc44c8a42c2a065f9f4f6974b41a7c5fba
SSDEEP

1536:S8VEUVSldQEUWgxvOaxMz3+ZkewyJir7uFz3/MLurpRdCpCA1dW:S8VEbdsW+vO6Mz3h9roz1rpRkzd

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
392	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3d15e6c18de827e82a8020e1c6475ba8.exe
"C:\Users\Admin\AppData\Local\Temp\3d15e6c18de827e82a8020e1c6475ba8.exe"
1⤵
PID:4156
- C:\Users\Admin\AppData\Roaming\Trojan.exe
  "C:\Users\Admin\AppData\Roaming\Trojan.exe"
  2⤵
  PID:3044

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Trojan.exe" "Trojan.exe" ENABLE
1⤵
- Modifies Windows Firewall
PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Trojan.exe

Filesize
123KB

MD5
3d15e6c18de827e82a8020e1c6475ba8

SHA1
4cac5c1f282875a7b3026b76c63eaea9bd71ce7d

SHA256
8ee76799220183625f317f176086db2c95af7099c1c0edf8dd6eff3711c4ad4f

SHA512
e600a8d516dccf91877853fffca0208d789f8972ebe2992eba65b57269cc4351e90687f5f6b1035305f7d9163eca6cfc44c8a42c2a065f9f4f6974b41a7c5fba

Download Submit
C:\Users\Admin\AppData\Roaming\Trojan.exe

Filesize
1KB

MD5
87e35530363841067e5bdf1fb6a54f4b

SHA1
6280af3c5f72a94b9e568b097dfb413b12e6619d

SHA256
6bd048137f2555d3c64c81b139f8b572bfacfe0696641e8e05e2a802a4a2078d

SHA512
3cfaa5ec4c5d66568b1204b608d9e4b03c9a0932fdffb79dcfa617e06639fd8e8dbef06f50109598dbc045b5a8e5d4a75cd801828c3c02e0f920cb0dbadc48f9

Download Submit
memory/3044-13-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/3044-16-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/3044-14-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/3044-18-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/4156-0-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/4156-2-0x0000000001710000-0x0000000001720000-memory.dmp

Filesize
64KB

Download
memory/4156-1-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/4156-12-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads