Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:06
Behavioral task
behavioral1
Sample
750b99a6c6e28c229d1f2b5b5ae73005.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
750b99a6c6e28c229d1f2b5b5ae73005.exe
Resource
win10v2004-20231222-en
General
-
Target
750b99a6c6e28c229d1f2b5b5ae73005.exe
-
Size
37KB
-
MD5
750b99a6c6e28c229d1f2b5b5ae73005
-
SHA1
0d93a2a4d0df8e52c9f2e2c28d7f0caba379b560
-
SHA256
5e750fac586cda27ec22494b9af9d8cd3ffbad6eb5457ddcdad34e3db988d7ee
-
SHA512
7de8043cc427532053746db354e4545349786c92e18299a59913283fe92dd55c5785b4ddec22fc3e17d5e60a9a169a481c20dffb88d7a824735453e85c998aaa
-
SSDEEP
384:tX2feVkvXXmVMqrWmx9hlHEYUrvt9kceFdJIZQ4G0+5OIwktBs1Hf4ch9eMLMIgL:l27vHa3rrx3Z7JIZV5kuf4YkKMIR7L0
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
750b99a6c6e28c229d1f2b5b5ae73005.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 750b99a6c6e28c229d1f2b5b5ae73005.exe -
Modifies Windows Firewall 2 TTPs 6 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 2540 netsh.exe 2824 netsh.exe 2892 netsh.exe 2544 netsh.exe 3000 netsh.exe 1048 netsh.exe -
Drops startup file 1 IoCs
Processes:
750b99a6c6e28c229d1f2b5b5ae73005.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe 750b99a6c6e28c229d1f2b5b5ae73005.exe -
Processes:
resource yara_rule behavioral1/memory/2204-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-3-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-4-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-10-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-12-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-13-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-14-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-15-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2204-16-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
750b99a6c6e28c229d1f2b5b5ae73005.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\engel = "C:\\Users\\Admin\\AppData\\Roaming\\updates\\updates.exe" 750b99a6c6e28c229d1f2b5b5ae73005.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
750b99a6c6e28c229d1f2b5b5ae73005.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\DHCP = "1055372" 750b99a6c6e28c229d1f2b5b5ae73005.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\DNS 750b99a6c6e28c229d1f2b5b5ae73005.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
750b99a6c6e28c229d1f2b5b5ae73005.exedescription pid process target process PID 2204 wrote to memory of 2540 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2540 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2540 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2540 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2824 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2824 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2824 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2824 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2892 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2892 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2892 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2892 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2544 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2544 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2544 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 2544 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 3000 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 3000 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 3000 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 3000 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 1048 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 1048 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 1048 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe PID 2204 wrote to memory of 1048 2204 750b99a6c6e28c229d1f2b5b5ae73005.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"1⤵
- Modifies firewall policy service
- Drops startup file
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="750b99a6c6e28c229d1f2b5b5ae73005" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"2⤵
- Modifies Windows Firewall
PID:2540 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="750b99a6c6e28c229d1f2b5b5ae73005" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"2⤵
- Modifies Windows Firewall
PID:2824 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="750b99a6c6e28c229d1f2b5b5ae73005" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"2⤵
- Modifies Windows Firewall
PID:2892 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="750b99a6c6e28c229d1f2b5b5ae73005" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"2⤵
- Modifies Windows Firewall
PID:2544 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="750b99a6c6e28c229d1f2b5b5ae73005" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"2⤵
- Modifies Windows Firewall
PID:3000 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="750b99a6c6e28c229d1f2b5b5ae73005" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\750b99a6c6e28c229d1f2b5b5ae73005.exe"2⤵
- Modifies Windows Firewall
PID:1048
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2204-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-3-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-4-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-10-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-11-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-12-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-13-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-14-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-15-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2204-16-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB