4f5eab20ce89ca95f447e6d9215e389d87de0837e444ffd6505e67d681ea77f7

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:16

Target

299ecd188ad0ca3be20f245bc720969f.exe
Size

6KB
MD5

299ecd188ad0ca3be20f245bc720969f
SHA1

754b5202b9ed40335b6239527e0f0fae62e5f7ab
SHA256

4f5eab20ce89ca95f447e6d9215e389d87de0837e444ffd6505e67d681ea77f7
SHA512

951bfb24d11abbb6e7930fb3d0f6b9e5ef87fd3508f207f970f30962fc622304ef5556140e7f21501c96f4fe44a337d7d21629e792be457aa7376f6f7b5a3ff3
SSDEEP

96:JUvu8PNpQHrsbwOrWnuVE7zgI4XUIi9qxZSf8ejA+s1e3/IESWsKuF:JUvu8PN+3OrJWOVwf8ek+We3/IrWTuF

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\kernels64.exe"	299ecd188ad0ca3be20f245bc720969f.exe

Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2732 netsh.exe

pid	process
2732	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\system32\\kernels64.exe"	299ecd188ad0ca3be20f245bc720969f.exe

Drops file in System32 directory 2 IoCs

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\kernels64.exe	299ecd188ad0ca3be20f245bc720969f.exe
File opened for modification	C:\Windows\SysWOW64\kernels64.exe	299ecd188ad0ca3be20f245bc720969f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

pid process

2088 299ecd188ad0ca3be20f245bc720969f.exe

pid	process
2088	299ecd188ad0ca3be20f245bc720969f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

299ecd188ad0ca3be20f245bc720969f.exe

description	pid	process	target process
PID 2088 wrote to memory of 2732	2088	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe
PID 2088 wrote to memory of 2732	2088	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe
PID 2088 wrote to memory of 2732	2088	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe
PID 2088 wrote to memory of 2732	2088	299ecd188ad0ca3be20f245bc720969f.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\299ecd188ad0ca3be20f245bc720969f.exe
"C:\Users\Admin\AppData\Local\Temp\299ecd188ad0ca3be20f245bc720969f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall set allowedprogram C:\Users\Admin\AppData\Local\Temp\299ecd188ad0ca3be20f245bc720969f.exe enable
  2⤵
  - Modifies Windows Firewall
  PID:2732