b58ebefe860027029bbbc807e0e77157c10b3ee3555bcaabe16ab049e81b1d51

Analysis

max time kernel
147s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123d3598026b2f9dca30a5ebadb5dfef.exe
Size

394KB
MD5

123d3598026b2f9dca30a5ebadb5dfef
SHA1

80823c8412d200e2365775d524fc10de5aaebf1f
SHA256

b58ebefe860027029bbbc807e0e77157c10b3ee3555bcaabe16ab049e81b1d51
SHA512

36959c4b80572232156eb8bbcb484657d37469f600b5874e67aa0fbac8f2ca7a504706cbdd7e1d0cab180237e7a5c992dadbec8d98377ef8659c1e59dc7a69ce
SSDEEP

6144:Bv0rexJ9uNmAe7RXsRtNbEkgycfy3J8+g39IE0BX73TxBKeFCXdcKUBFMIE6A1Kj:DJgNpeZGbEXy58J39cBX7tBdCXdDUNKa

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	123d3598026b2f9dca30a5ebadb5dfef.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	123d3598026b2f9dca30a5ebadb5dfef.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	123d3598026b2f9dca30a5ebadb5dfef.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\123d3598026b2f9dca30a5ebadb5dfef.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\123d3598026b2f9dca30a5ebadb5dfef.exe:*:Enabled:mtookab"	123d3598026b2f9dca30a5ebadb5dfef.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4784	123d3598026b2f9dca30a5ebadb5dfef.exe

C:\Users\Admin\AppData\Local\Temp\123d3598026b2f9dca30a5ebadb5dfef.exe
"C:\Users\Admin\AppData\Local\Temp\123d3598026b2f9dca30a5ebadb5dfef.exe"
1⤵
- Modifies firewall policy service
- Suspicious behavior: GetForegroundWindowSpam
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4784-0-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4784-2-0x0000000002A20000-0x0000000002B10000-memory.dmp

Filesize
960KB

Download
memory/4784-3-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download
memory/4784-1-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4784-5-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4784-6-0x0000000000400000-0x0000000000B12000-memory.dmp

Filesize
7.1MB

Download
memory/4784-8-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads