2ceab2b5c3aaec25672ae2511e6fd6fc9cf581cfbb7bf6ca3c5f811247636e49

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6c6fea8b1b1f32667025aff97b94eb7.exe
Size

63KB
MD5

b6c6fea8b1b1f32667025aff97b94eb7
SHA1

953570f041f5c3bc17cd9f8c28dda98a1462f091
SHA256

2ceab2b5c3aaec25672ae2511e6fd6fc9cf581cfbb7bf6ca3c5f811247636e49
SHA512

2e94cc2a0631bcd6dcd53d60ac24df0f9653f3db6bf6f49fa959d534286c91053d1032a2a4e1c5f24e23aa3282a55b78b274fb7404d363d8e3664e326f926691
SSDEEP

1536:ZZXzDxHK9AoVwNKu2+dSCRfDT1pK+h66n7QeBBry:ZNzDgAoVwNKu2M3RbBrZc4By

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2744	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/348-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/348-1-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/348-4-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/348-10-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed8-14.dat	upx
behavioral1/memory/348-21-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2712-23-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2712-24-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Help\explorer.exe	b6c6fea8b1b1f32667025aff97b94eb7.exe
File opened for modification	C:\Windows\Help\explorer.exe	b6c6fea8b1b1f32667025aff97b94eb7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe
348	b6c6fea8b1b1f32667025aff97b94eb7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2744	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	30
PID 348 wrote to memory of 2744	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	30
PID 348 wrote to memory of 2744	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	30
PID 348 wrote to memory of 2744	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	30
PID 348 wrote to memory of 2712	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	32
PID 348 wrote to memory of 2712	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	32
PID 348 wrote to memory of 2712	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	32
PID 348 wrote to memory of 2712	348	b6c6fea8b1b1f32667025aff97b94eb7.exe	32

C:\Users\Admin\AppData\Local\Temp\b6c6fea8b1b1f32667025aff97b94eb7.exe
"C:\Users\Admin\AppData\Local\Temp\b6c6fea8b1b1f32667025aff97b94eb7.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set allowedprogram program = "C:\Windows\Help\explorer.exe" name = "Explorer" mode = ENABLE scope = ALL profile = ALL
  2⤵
  - Modifies Windows Firewall
  PID:2744
- C:\Windows\Help\explorer.exe
  "C:\Windows\Help\explorer.exe" C:\noexistfile.txt
  2⤵
  - Executes dropped EXE
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Help\explorer.exe

Filesize
63KB

MD5
b6c6fea8b1b1f32667025aff97b94eb7

SHA1
953570f041f5c3bc17cd9f8c28dda98a1462f091

SHA256
2ceab2b5c3aaec25672ae2511e6fd6fc9cf581cfbb7bf6ca3c5f811247636e49

SHA512
2e94cc2a0631bcd6dcd53d60ac24df0f9653f3db6bf6f49fa959d534286c91053d1032a2a4e1c5f24e23aa3282a55b78b274fb7404d363d8e3664e326f926691

Download Submit
memory/348-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/348-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/348-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/348-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/348-21-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/348-20-0x00000000027E0000-0x000000000280B000-memory.dmp

Filesize
172KB

Download
memory/2712-23-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2712-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download