Analysis

  • max time kernel
    141s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 23:45

General

  • Target

    820d86d2c6c6e21e32df11eb3ce5b6d705c4ff505d16e6de9e0a43df741c347a.exe

  • Size

    479KB

  • MD5

    7302a62827eddd8fe88cad08893ddc06

  • SHA1

    15bbe66ce94ad8e2c3cd2684132326ab490fec98

  • SHA256

    820d86d2c6c6e21e32df11eb3ce5b6d705c4ff505d16e6de9e0a43df741c347a

  • SHA512

    3840a31054fcbd84d3d423f4d150086f3ea376f13c9bc753d24e5dc97fc06e90c543d7e4133e322953f5bed82c31389e94222bc63668de02a40e728ec41734af

  • SSDEEP

    6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnWP:nRDc3yWDNU+YUznzNjElWaT07NQtDWP

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\820d86d2c6c6e21e32df11eb3ce5b6d705c4ff505d16e6de9e0a43df741c347a.exe
    "C:\Users\Admin\AppData\Local\Temp\820d86d2c6c6e21e32df11eb3ce5b6d705c4ff505d16e6de9e0a43df741c347a.exe"
    1⤵
    • Modifies firewall policy service
    • Adds policy Run key to start application
    • Sets service image path in registry
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:4316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\msrpc.exe

    Filesize

    479KB

    MD5

    ece22f6e9117a1acc2ecde987059212e

    SHA1

    3a8a469f9a7272a5a20cd09c856a46c38aa9641c

    SHA256

    caaf04ef2f7b681aaf09de6cc8287f91a2278c2c065370c2b394acc22d2ad842

    SHA512

    0514f294ced20084fd552d61efaa3091cce517ead49763b3e20fd8b049015cd91ed6b6315a6b203f866ae0646aef0d3b327e4c3eb32b8f9355327f3738974053

  • memory/4316-0-0x00000000020E0000-0x00000000020E1000-memory.dmp

    Filesize

    4KB

  • memory/4316-1-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-18-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-19-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-20-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-21-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-22-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-23-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-24-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/4316-25-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB