9b22254d5a2c0412809887058d33985a3fe14ecf7532aa1e655f4b2c7504bbb3

Analysis

max time kernel
147s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4c36852a24619e2e4d259fe1b74a87a.exe
Size

89KB
MD5

c4c36852a24619e2e4d259fe1b74a87a
SHA1

3685cd9f9e7e4741ad04898f8e62f49d1f85fd3a
SHA256

9b22254d5a2c0412809887058d33985a3fe14ecf7532aa1e655f4b2c7504bbb3
SHA512

8b0fd9e53b807bbfba723a5c4c901b885e8c6a1ad5e4f7031c625d01aa0eeea51e7e6308f77f5c20f96b602b81af30c4af62b61532f340dc15451bfc7bebadde
SSDEEP

1536:7wL+euwJiLFNsPU5G5KQpPrZjq84Iw0FIz2QE1tlhAHz:7ocLnsPUT2zZjrQU7o

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	c4c36852a24619e2e4d259fe1b74a87a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	c4c36852a24619e2e4d259fe1b74a87a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	c4c36852a24619e2e4d259fe1b74a87a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\c4c36852a24619e2e4d259fe1b74a87a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c4c36852a24619e2e4d259fe1b74a87a.exe:*:Enabled:csrss"	c4c36852a24619e2e4d259fe1b74a87a.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	c4c36852a24619e2e4d259fe1b74a87a.exe

C:\Users\Admin\AppData\Local\Temp\c4c36852a24619e2e4d259fe1b74a87a.exe
"C:\Users\Admin\AppData\Local\Temp\c4c36852a24619e2e4d259fe1b74a87a.exe"
1⤵
- Modifies firewall policy service
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000000580000-0x000000000059F000-memory.dmp

Filesize
124KB

Download
memory/3940-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3940-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3940-18-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3940-26-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads