Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 03:17
Behavioral task
behavioral1
Sample
ad8d87e465deebc22385a0445e12895d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad8d87e465deebc22385a0445e12895d.exe
Resource
win10v2004-20240226-en
General
-
Target
ad8d87e465deebc22385a0445e12895d.exe
-
Size
180KB
-
MD5
ad8d87e465deebc22385a0445e12895d
-
SHA1
c0b1d0eb620e15ac664d204fe956f3adaeed2a29
-
SHA256
0be71b7842db24b8d8b079a9416fd23d0b2c2a78e1fe972781037205cd6e286f
-
SHA512
0b89bf5f3334e6115dd6dca13b548e8668a8a4277ffe67d488426fc183f02578ec1dde351a2c60e012a433e4d7116aeefa9b578bfd401955bcb7e503039d28c6
-
SSDEEP
3072:xYdUOpBR+f16nPjtrZf2Sce0gsKlQvrBmjW48nZn2Sfx8z5aZDZMzwmkc8qAs:xJQZZflcebsZv0joZxx8whZM3kc7As
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts ad8d87e465deebc22385a0445e12895d.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\2024:TCP = "2024:TCP:*:Enabled:system32.dll" ad8d87e465deebc22385a0445e12895d.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ad8d87e465deebc22385a0445e12895d.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile ad8d87e465deebc22385a0445e12895d.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications ad8d87e465deebc22385a0445e12895d.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ad8d87e465deebc22385a0445e12895d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad8d87e465deebc22385a0445e12895d.exe:*:Enabled:system32.dll" ad8d87e465deebc22385a0445e12895d.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List ad8d87e465deebc22385a0445e12895d.exe -
resource yara_rule behavioral2/files/0x000800000002322e-5.dat aspack_v212_v242 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplida = "C:\\Windows\\system32\\ad8d87e465deebc22385a0445e12895d.exe" ad8d87e465deebc22385a0445e12895d.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ad8d87e465deebc22385a0445e12895d.exe ad8d87e465deebc22385a0445e12895d.exe File opened for modification C:\Windows\SysWOW64\ad8d87e465deebc22385a0445e12895d.exe ad8d87e465deebc22385a0445e12895d.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2336 3668 WerFault.exe 89 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3668 ad8d87e465deebc22385a0445e12895d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad8d87e465deebc22385a0445e12895d.exe"C:\Users\Admin\AppData\Local\Temp\ad8d87e465deebc22385a0445e12895d.exe"1⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:3668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 4442⤵
- Program crash
PID:2336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3668 -ip 36681⤵PID:444
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5ad8d87e465deebc22385a0445e12895d
SHA1c0b1d0eb620e15ac664d204fe956f3adaeed2a29
SHA2560be71b7842db24b8d8b079a9416fd23d0b2c2a78e1fe972781037205cd6e286f
SHA5120b89bf5f3334e6115dd6dca13b548e8668a8a4277ffe67d488426fc183f02578ec1dde351a2c60e012a433e4d7116aeefa9b578bfd401955bcb7e503039d28c6