0983711a6cc222d52cf7dd6092c6232126a12736f379f64d5b8cf4f4a475fd5e

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09e05ec2fa77c042dd48b23bd87af5d1.exe
Size

3.8MB
MD5

09e05ec2fa77c042dd48b23bd87af5d1
SHA1

2ec328691c32e8ac656996e807dffcb79be4bd1e
SHA256

0983711a6cc222d52cf7dd6092c6232126a12736f379f64d5b8cf4f4a475fd5e
SHA512

134f9b06ea9837f6480b2bda9bc4360d1fd12685fc5cb7f2dd0363f9d57ee29a06bb3c19573f20ad8fa0e3ef2384b76341a1490d87758349a2158b294f1937c6
SSDEEP

98304:UFaONQkFkUZV8LZZilJvvu0MxJL+6ffjbW3bvdPGVmF1nDWSEnl/:UFayFhAZOvqp+6ffPAZPImTKScl

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
3016	netsh.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\0172847.tmp	09e05ec2fa77c042dd48b23bd87af5d1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	09e05ec2fa77c042dd48b23bd87af5d1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3016	2512	09e05ec2fa77c042dd48b23bd87af5d1.exe	18
PID 2512 wrote to memory of 3016	2512	09e05ec2fa77c042dd48b23bd87af5d1.exe	18
PID 2512 wrote to memory of 3016	2512	09e05ec2fa77c042dd48b23bd87af5d1.exe	18
PID 2512 wrote to memory of 3016	2512	09e05ec2fa77c042dd48b23bd87af5d1.exe	18

C:\Users\Admin\AppData\Local\Temp\09e05ec2fa77c042dd48b23bd87af5d1.exe
"C:\Users\Admin\AppData\Local\Temp\09e05ec2fa77c042dd48b23bd87af5d1.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000000400000-0x00000000018EE000-memory.dmp

Filesize
20.9MB

Download
memory/2512-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2512-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2512-5-0x0000000000400000-0x00000000018EE000-memory.dmp

Filesize
20.9MB

Download
memory/2512-6-0x0000000000400000-0x00000000018EE000-memory.dmp

Filesize
20.9MB

Download
memory/2512-8-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2512-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads