a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
Size

182KB
MD5

01f2128134a3f10b34844758ecaf6221
SHA1

dd1c0bc149abd29d6ba62a61e6e2014d631497e9
SHA256

a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad
SHA512

6d957ec8feeb298cfa23f7d932286bc2e1abe9ec057fee288cd8c522d9099199111bff9e55738a3a2aea49b8a9ab98a426247c05ef1038bed3d6b456e8d912a6
SSDEEP

3072:W++Y/lmp5JrIaLHv67rhIQDR3Y9lNVZTzW1Pl2eo2uGFXHaD6SCxkbT3z2J:iY/lmp5Z567raQqlNT3EtDuGHaDZTz2J

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\A5B7DB~1.EXE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A5B7DB~1.EXE:*:Enabled:DNS"	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe"	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe"	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\svchost.exe	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe

C:\Users\Admin\AppData\Local\Temp\a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe
"C:\Users\Admin\AppData\Local\Temp\a5b7db963d695f619ea3cd6bc1280cb3d0a235043fafc128193a07de5b21a4ad.exe"
1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
293KB

MD5
27ffd6c0b721ec59f73ecfd2264bc890

SHA1
ec47e1186426d28f22f515c2146673e4c9b43b64

SHA256
51dc640dd2a7958e43dbc634e6c4fe343042f3d497a3d67efc61079fbaac367a

SHA512
0e60799a7bf9d60e69cab3d105821749604be7b5d579578a7cdc90d4596065fb8b8912157958a31d80ae838400e266039fc21de11e9aee7b67a2d55624828e02

Download Submit