Analysis
-
max time kernel
126s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:52
Behavioral task
behavioral1
Sample
61579b11c827ae08a2e82a502f3d4d39.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
61579b11c827ae08a2e82a502f3d4d39.exe
-
Size
291KB
-
MD5
61579b11c827ae08a2e82a502f3d4d39
-
SHA1
664dc578b8c7312ea3e365abc5904349cea12f10
-
SHA256
a567910a720b0cd7e40fbac9cf7da676b83af58fc11b95797558226a20c2a13a
-
SHA512
23dae36f25cff0dbd2c19c3c8390f54e1e41f3c3cb7bd5004c5bff445942190f03cc24c3546159b5a8c2a101dc604deec8f988b8120e1a04f5f89c49109fc917
-
SSDEEP
6144:ZYDhB6ActM8FbPt6a15RGkPNJAcb+k2WzoPiML3AYRYAe5mYklLUvUSy:i9BvctM85t35JPNJj2WzoRLQYRYzmYo5
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 2732 netsh.exe 2840 netsh.exe -
resource yara_rule behavioral1/memory/2284-0-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-1-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-2-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-3-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-4-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-5-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-6-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-7-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-8-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-9-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-10-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-11-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-12-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-13-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2284-14-0x0000000000400000-0x00000000004BD000-memory.dmp upx -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2284-1-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-2-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-3-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-4-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-5-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-6-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-7-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-8-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-9-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-10-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-11-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-12-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-13-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe behavioral1/memory/2284-14-0x0000000000400000-0x00000000004BD000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe 2284 61579b11c827ae08a2e82a502f3d4d39.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2412 2284 61579b11c827ae08a2e82a502f3d4d39.exe 17 PID 2284 wrote to memory of 2412 2284 61579b11c827ae08a2e82a502f3d4d39.exe 17 PID 2284 wrote to memory of 2412 2284 61579b11c827ae08a2e82a502f3d4d39.exe 17 PID 2284 wrote to memory of 2412 2284 61579b11c827ae08a2e82a502f3d4d39.exe 17 PID 2412 wrote to memory of 2732 2412 cmd.exe 22 PID 2412 wrote to memory of 2732 2412 cmd.exe 22 PID 2412 wrote to memory of 2732 2412 cmd.exe 22 PID 2412 wrote to memory of 2732 2412 cmd.exe 22 PID 2284 wrote to memory of 2804 2284 61579b11c827ae08a2e82a502f3d4d39.exe 33 PID 2284 wrote to memory of 2804 2284 61579b11c827ae08a2e82a502f3d4d39.exe 33 PID 2284 wrote to memory of 2804 2284 61579b11c827ae08a2e82a502f3d4d39.exe 33 PID 2284 wrote to memory of 2804 2284 61579b11c827ae08a2e82a502f3d4d39.exe 33 PID 2804 wrote to memory of 2840 2804 cmd.exe 32 PID 2804 wrote to memory of 2840 2804 cmd.exe 32 PID 2804 wrote to memory of 2840 2804 cmd.exe 32 PID 2804 wrote to memory of 2840 2804 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\61579b11c827ae08a2e82a502f3d4d39.exe"C:\Users\Admin\AppData\Local\Temp\61579b11c827ae08a2e82a502f3d4d39.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall set opmode disable2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh advfirewall set allprofiles state off2⤵
- Suspicious use of WriteProcessMemory
PID:2804
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state off1⤵
- Modifies Windows Firewall
PID:2840