47cf19204ed7b766915eaabdb2182d9b202f5eda072f9139e280557adfb1e86d

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client/InsFilt.exe
Size

94KB
MD5

98e5ce2d6932f84fd18eacf021588bb3
SHA1

e3d94f0165b898a5c5dc9fe5cf24a5e2b1e43957
SHA256

4b6630680705908ef8ba0b76bf630109d9cedde6474ccba1586c2c956e75494d
SHA512

cb9ecbe1c84365c0198e74fc149a2b6546cb74c6a21186737f7153aed88f40087e78c082cad96df159f48e41a4c8f5055e5e978c7019ae89ab9fd6fe5a1fcf6f
SSDEEP

1536:oEq5pUQ7/XliYXc+0CwwhIrK5HqR4FlDXHBmb6z0fS/w6TxVPLONG4mPhw:SpUq/VV0ZwhgK5KR4HThmb6z0K/HxdLq

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

InsFilt.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\seipdrv.sys	InsFilt.exe
File opened for modification	C:\Windows\SysWOW64\drivers\seipdrv.sys	InsFilt.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

InsFilt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\seMyIpFilt\ImagePath = "system32\\drivers\\seipdrv.sys"	InsFilt.exe

C:\Users\Admin\AppData\Local\Temp\Client\InsFilt.exe
"C:\Users\Admin\AppData\Local\Temp\Client\InsFilt.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download