6e9b219964b506bbe0303dfec35424b1b82bca58881a56f66fd44278c7b5e475

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

1.4MB
MD5

926cef890758c6a2b909c9e7fd1879e0
SHA1

582db6f11b68c048dac57e859dcab1aad3f17900
SHA256

b4473f82d1dd99fc9a6cf25c5087382abe4d9a9807abed8d4977474611eec439
SHA512

044cc65b79d12bc4223e4c53ffec70e9214d3186947b2041d5b87c696397067125d6217bcbe5e4faeaaec854773e85cd4b4a8826de49604c3575d743d54fcae6
SSDEEP

24576:9wsEw1ck6dna89A641svDZVpwUVmodmUE3D/jAyNcGQtEwIYhh:h9cZda8C1sb9VmmmUGDLhcLIYhh

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2564	netsh.exe
2652	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	appperf.exe
2916	appperf.exe

Loads dropped DLL 5 IoCs

pid	Process
1364	Setup.exe
1364	Setup.exe
2948	appperf.exe
2948	appperf.exe
2948	appperf.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	appperf.exe
File created	C:\Windows\SysWOW64\appperf.exe	Setup.exe
File opened for modification	C:\Windows\SysWOW64\appperf.exe	Setup.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71\WpadDecisionTime = 900385129676da01	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	appperf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadDecisionReason = "1"	appperf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	appperf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71\WpadDecisionReason = "1"	appperf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-31-c2-07-c2-71\WpadDecision = "0"	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	appperf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	appperf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	appperf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	appperf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}	appperf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\a6-31-c2-07-c2-71	appperf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	appperf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	appperf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	appperf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadDecisionTime = 900385129676da01	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	appperf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	appperf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadDecision = "0"	appperf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05DB305D-CA71-4505-BC2E-545E25E0D935}\WpadNetworkName = "Network 3"	appperf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2916	appperf.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 1364 wrote to memory of 2948	1364	Setup.exe	28
PID 2916 wrote to memory of 2652	2916	appperf.exe	30
PID 2916 wrote to memory of 2652	2916	appperf.exe	30
PID 2916 wrote to memory of 2652	2916	appperf.exe	30
PID 2916 wrote to memory of 2652	2916	appperf.exe	30
PID 2916 wrote to memory of 2564	2916	appperf.exe	32
PID 2916 wrote to memory of 2564	2916	appperf.exe	32
PID 2916 wrote to memory of 2564	2916	appperf.exe	32
PID 2916 wrote to memory of 2564	2916	appperf.exe	32

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\appperf.exe
  "C:\Windows\system32\appperf.exe" /i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2948

C:\Windows\SysWOW64\appperf.exe
"C:\Windows\SysWOW64\appperf.exe" /s /p 27016
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="appperf.exe"
  2⤵
  - Modifies Windows Firewall
  - Modifies data under HKEY_USERS
  PID:2652
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall firewall add rule name="appperf.exe" dir=in action=allow program="C:\Windows\SysWOW64\appperf.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Modifies data under HKEY_USERS
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\appperf.exe

Filesize
1.4MB

MD5
926cef890758c6a2b909c9e7fd1879e0

SHA1
582db6f11b68c048dac57e859dcab1aad3f17900

SHA256
b4473f82d1dd99fc9a6cf25c5087382abe4d9a9807abed8d4977474611eec439

SHA512
044cc65b79d12bc4223e4c53ffec70e9214d3186947b2041d5b87c696397067125d6217bcbe5e4faeaaec854773e85cd4b4a8826de49604c3575d743d54fcae6

Download Submit
memory/1364-0-0x00000000023B0000-0x00000000024B0000-memory.dmp

Filesize
1024KB

Download
memory/1364-1-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1364-29-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2916-23-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/2916-30-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2916-31-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2916-32-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/2948-17-0x00000000022E0000-0x00000000023E0000-memory.dmp

Filesize
1024KB

Download
memory/2948-28-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads