38a1267e721facf230c6819a6674adcaf05723869a0851732bad5481858afc4c

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46aacc95329fd562a04b7627490b9c3a.exe
Size

89KB
MD5

46aacc95329fd562a04b7627490b9c3a
SHA1

7d529744638be003c63b0202b28213308f97f6b7
SHA256

38a1267e721facf230c6819a6674adcaf05723869a0851732bad5481858afc4c
SHA512

0a494d61243cf5d40451b3d3d1e07d8326c1eacf236eb14458c80204b3a164430341fd8296a199574e7f0a58b5d1325d92c8d9bac85affdb0b2f5ee550d7e00d
SSDEEP

1536:nzwL+euwJiLFNsPU5G5KQpPrZjq84Iw0FIz2QE1tlhAHz:nzocLnsPUT2zZjrQUbo

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	46aacc95329fd562a04b7627490b9c3a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	46aacc95329fd562a04b7627490b9c3a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	46aacc95329fd562a04b7627490b9c3a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	46aacc95329fd562a04b7627490b9c3a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\46aacc95329fd562a04b7627490b9c3a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\46aacc95329fd562a04b7627490b9c3a.exe:*:Enabled:csrss"	46aacc95329fd562a04b7627490b9c3a.exe

C:\Users\Admin\AppData\Local\Temp\46aacc95329fd562a04b7627490b9c3a.exe
"C:\Users\Admin\AppData\Local\Temp\46aacc95329fd562a04b7627490b9c3a.exe"
1⤵
- Modifies firewall policy service
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5000-0-0x0000000002190000-0x00000000021AF000-memory.dmp

Filesize
124KB

Download
memory/5000-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5000-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5000-18-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5000-26-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads