Analysis
-
max time kernel
52s -
max time network
64s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-06-2024 17:47
Static task
static1
Behavioral task
behavioral1
Sample
file/setup.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
file/setup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
file/setup.exe
Resource
win11-20240508-en
General
-
Target
file/setup.exe
-
Size
724.0MB
-
MD5
81070ccb98cdd23344375c03acfd88ef
-
SHA1
7ac9cd45977e091869b651ed3c1e67a7a08cf601
-
SHA256
59fc1d6f6f94715eb00e104234dfb5dbb553488ce611c89177565c972d471520
-
SHA512
6213fb65173710da7a3c7fb705ab1bd4596545d906d9db96cce61e9ae4652a110b828c11fc6358b38e8897fd5989aad3dcbfdce311ac0621aa9e2aab90ff14d9
-
SSDEEP
196608:QTae6o2p7r55Bvyk+c9rWVCePOy7oac4RymLr+XGdkyRk6S:3g2115BqkdyN79tidd
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" setup.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops file in System32 directory 4 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy setup.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini setup.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol setup.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
setup.exepid process 2148 setup.exe 2148 setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file\setup.exe"C:\Users\Admin\AppData\Local\Temp\file\setup.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
memory/2148-2-0x00007FFEFAD00000-0x00007FFEFAD02000-memory.dmpFilesize
8KB
-
memory/2148-0-0x00007FFEFB3D0000-0x00007FFEFB3D2000-memory.dmpFilesize
8KB
-
memory/2148-1-0x00007FFEFB3E0000-0x00007FFEFB3E2000-memory.dmpFilesize
8KB
-
memory/2148-3-0x00007FF683515000-0x00007FF683BF5000-memory.dmpFilesize
6.9MB
-
memory/2148-6-0x00007FFEF8A40000-0x00007FFEF8A42000-memory.dmpFilesize
8KB
-
memory/2148-5-0x00007FFEF8A30000-0x00007FFEF8A32000-memory.dmpFilesize
8KB
-
memory/2148-4-0x00007FFEFAD10000-0x00007FFEFAD12000-memory.dmpFilesize
8KB
-
memory/2148-7-0x00007FF6833B0000-0x00007FF6847D4000-memory.dmpFilesize
20.1MB
-
memory/2148-18-0x00007FF683515000-0x00007FF683BF5000-memory.dmpFilesize
6.9MB