6565e01ed6a8b1af84df9e0fbbf58415590b45041c7b0aa2b0b8d11745f20392

Analysis

max time kernel
56s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8429642de994dec9e1401103bb15d9f.exe
Size 64KB
Sample240308-c7myradd55
SHA256 6565e01ed6a8b1af84df9e0fbbf58415590b45041c7b0aa2b0b8d11745f20392
MD5 b8429642de994dec9e1401103bb15d9f
SHA1 962b93187b9b7208f861a1d711179346b06a44fe
SHA512 bd6debb24899be17c703d8bea0db09e5fc30204bfaacbeb25c03e86f64bd14e74657a0d3cafd671ce82d855eeb65397c967b47c32fc8e064424c3a42e4310fa5
SSDEEP 1536:31EuBxBTPUSnVn7NhYUIcDu7+BBTPUSnVn7N:FxBTPUSnVn7Nh9Lw+BBTPUSnVn7N
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3672	netsh.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	b8429642de994dec9e1401103bb15d9f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3672	2492	b8429642de994dec9e1401103bb15d9f.exe	91
PID 2492 wrote to memory of 3672	2492	b8429642de994dec9e1401103bb15d9f.exe	91
PID 2492 wrote to memory of 3672	2492	b8429642de994dec9e1401103bb15d9f.exe	91

C:\Users\Admin\AppData\Local\Temp\b8429642de994dec9e1401103bb15d9f.exe
"C:\Users\Admin\AppData\Local\Temp\b8429642de994dec9e1401103bb15d9f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\netsh.exe
  netsh.exe firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads