b2b1f374822e760b574cff680d989d0f229bdaf9029acacb2449162b92bbc16b

Analysis

max time kernel
4s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rustyz.exe
Size

120KB
MD5

72bcd7f24413629f6b194c718af7b39e
SHA1

8495ab957722ea594b4a45a8a7522b9a24d23988
SHA256

43a8ced5b270b43b025b166f5069446de5c15479dcb049034f7db073153ebce4
SHA512

d5c9f01857e20fef93a8dc2e854bd3d18cf4c8d712eb6bf416f740c2e17eb14d9afa7eb9afb9241261bbfb07ab066447f6b22c9f78b815416d392329265a5213
SSDEEP

1536:94WHOJOV+P1tMZw1pSqvarF8TfHlo6nu/dhIo7RkSQAVE4Zks:94nzHn1nHllnu/co7aGV3Zks

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2916	netsh.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2284	Rustyz.exe

C:\Users\Admin\AppData\Local\Temp\Rustyz.exe
"C:\Users\Admin\AppData\Local\Temp\Rustyz.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2284
- C:\Users\Admin\AppData\Roaming\services.exe
  /d C:\Users\Admin\AppData\Local\Temp\Rustyz.exe
  2⤵
  PID:2912
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\services.exe" CityScape Enable
  2⤵
  - Modifies Windows Firewall
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\services.exe

Filesize
120KB

MD5
a60035dddb47cd584658f14ec24273be

SHA1
1ad94a46c78e9f95bc001a9d69c8575e682ab6a3

SHA256
4139aa80337c46838ddf6239907b65a7bb6d29d6d4e9e000a4f17374db9b34d9

SHA512
3e53077dea12dc70e608e57d789afe72eb2262b0db243e496bf3cc7be2262ad2808a0c05d2fc4796bccd2f40b3533397a9d272702e1c8c76f29d3643f069f005

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads