a567910a720b0cd7e40fbac9cf7da676b83af58fc11b95797558226a20c2a13a

Analysis

max time kernel
1s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61579b11c827ae08a2e82a502f3d4d39.exe
Size

291KB
MD5

61579b11c827ae08a2e82a502f3d4d39
SHA1

664dc578b8c7312ea3e365abc5904349cea12f10
SHA256

a567910a720b0cd7e40fbac9cf7da676b83af58fc11b95797558226a20c2a13a
SHA512

23dae36f25cff0dbd2c19c3c8390f54e1e41f3c3cb7bd5004c5bff445942190f03cc24c3546159b5a8c2a101dc604deec8f988b8120e1a04f5f89c49109fc917
SSDEEP

6144:ZYDhB6ActM8FbPt6a15RGkPNJAcb+k2WzoPiML3AYRYAe5mYklLUvUSy:i9BvctM85t35JPNJj2WzoRLQYRYzmYo5

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
5012	netsh.exe
4964	netsh.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3368-0-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral2/memory/3368-1-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral2/memory/3368-2-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral2/memory/3368-3-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral2/memory/3368-4-0x0000000000400000-0x00000000004BD000-memory.dmp	upx
behavioral2/memory/3368-5-0x0000000000400000-0x00000000004BD000-memory.dmp	upx

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3368-1-0x0000000000400000-0x00000000004BD000-memory.dmp	autoit_exe
behavioral2/memory/3368-2-0x0000000000400000-0x00000000004BD000-memory.dmp	autoit_exe
behavioral2/memory/3368-3-0x0000000000400000-0x00000000004BD000-memory.dmp	autoit_exe
behavioral2/memory/3368-4-0x0000000000400000-0x00000000004BD000-memory.dmp	autoit_exe
behavioral2/memory/3368-5-0x0000000000400000-0x00000000004BD000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3368	61579b11c827ae08a2e82a502f3d4d39.exe
3368	61579b11c827ae08a2e82a502f3d4d39.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3368	61579b11c827ae08a2e82a502f3d4d39.exe
3368	61579b11c827ae08a2e82a502f3d4d39.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4480	3368	61579b11c827ae08a2e82a502f3d4d39.exe	25
PID 3368 wrote to memory of 4480	3368	61579b11c827ae08a2e82a502f3d4d39.exe	25
PID 3368 wrote to memory of 4480	3368	61579b11c827ae08a2e82a502f3d4d39.exe	25
PID 4480 wrote to memory of 5012	4480	cmd.exe	21
PID 4480 wrote to memory of 5012	4480	cmd.exe	21
PID 4480 wrote to memory of 5012	4480	cmd.exe	21
PID 3368 wrote to memory of 3764	3368	61579b11c827ae08a2e82a502f3d4d39.exe	34
PID 3368 wrote to memory of 3764	3368	61579b11c827ae08a2e82a502f3d4d39.exe	34
PID 3368 wrote to memory of 3764	3368	61579b11c827ae08a2e82a502f3d4d39.exe	34

C:\Users\Admin\AppData\Local\Temp\61579b11c827ae08a2e82a502f3d4d39.exe
"C:\Users\Admin\AppData\Local\Temp\61579b11c827ae08a2e82a502f3d4d39.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C netsh firewall set opmode disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C netsh advfirewall set allprofiles state off
  2⤵
  PID:3764

C:\Windows\SysWOW64\netsh.exe
netsh firewall set opmode disable
1⤵
- Modifies Windows Firewall
PID:5012

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set allprofiles state off
1⤵
- Modifies Windows Firewall
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3368-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-1-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-2-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-3-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-4-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-5-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-6-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-7-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-8-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-9-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-11-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-12-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-13-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3368-14-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads