Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 03:17
Behavioral task
behavioral1
Sample
ad8d87e465deebc22385a0445e12895d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad8d87e465deebc22385a0445e12895d.exe
Resource
win10v2004-20240226-en
General
-
Target
ad8d87e465deebc22385a0445e12895d.exe
-
Size
180KB
-
MD5
ad8d87e465deebc22385a0445e12895d
-
SHA1
c0b1d0eb620e15ac664d204fe956f3adaeed2a29
-
SHA256
0be71b7842db24b8d8b079a9416fd23d0b2c2a78e1fe972781037205cd6e286f
-
SHA512
0b89bf5f3334e6115dd6dca13b548e8668a8a4277ffe67d488426fc183f02578ec1dde351a2c60e012a433e4d7116aeefa9b578bfd401955bcb7e503039d28c6
-
SSDEEP
3072:xYdUOpBR+f16nPjtrZf2Sce0gsKlQvrBmjW48nZn2Sfx8z5aZDZMzwmkc8qAs:xJQZZflcebsZv0joZxx8whZM3kc7As
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\2024:TCP = "2024:TCP:*:Enabled:system32.dll" ad8d87e465deebc22385a0445e12895d.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ad8d87e465deebc22385a0445e12895d.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ad8d87e465deebc22385a0445e12895d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad8d87e465deebc22385a0445e12895d.exe:*:Enabled:system32.dll" ad8d87e465deebc22385a0445e12895d.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List ad8d87e465deebc22385a0445e12895d.exe -
resource yara_rule behavioral1/files/0x0001000000000026-5.dat aspack_v212_v242 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplida = "C:\\Windows\\system32\\ad8d87e465deebc22385a0445e12895d.exe" ad8d87e465deebc22385a0445e12895d.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ad8d87e465deebc22385a0445e12895d.exe ad8d87e465deebc22385a0445e12895d.exe File opened for modification C:\Windows\SysWOW64\ad8d87e465deebc22385a0445e12895d.exe ad8d87e465deebc22385a0445e12895d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 ad8d87e465deebc22385a0445e12895d.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5ad8d87e465deebc22385a0445e12895d
SHA1c0b1d0eb620e15ac664d204fe956f3adaeed2a29
SHA2560be71b7842db24b8d8b079a9416fd23d0b2c2a78e1fe972781037205cd6e286f
SHA5120b89bf5f3334e6115dd6dca13b548e8668a8a4277ffe67d488426fc183f02578ec1dde351a2c60e012a433e4d7116aeefa9b578bfd401955bcb7e503039d28c6