ff89b26b08534382d19d9c99b8023467c007eda8c8a82cd728fb24634d99bb58

Analysis

max time kernel
504s
max time network
514s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19-06-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1718821613.976287_setup (2).exe
Size

12.6MB
MD5

dddae2b25f60e6331ab468bb5d9daf65
SHA1

93b425a91af75bdad1e27b08cd821b0123c9e61b
SHA256

ff89b26b08534382d19d9c99b8023467c007eda8c8a82cd728fb24634d99bb58
SHA512

d25580cb033c0cc1a68b1ab49166c8d6c0c6387ad690a92ff43e4ca1baf317e2ff68dd05d8f1c14e54cbedad9198cd51932aca7c7b05afe92eb1de6e3b4893c3
SSDEEP

393216:nxF2TkLoD4NFAKgkhC1LxRdYUmRMGhw4:qTkLoDO0PL/d5mK

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

1718821613.976287_setup (2).exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	1718821613.976287_setup (2).exe

Drops file in System32 directory 4 IoCs

Processes:

1718821613.976287_setup (2).exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1718821613.976287_setup (2).exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1718821613.976287_setup (2).exe
File opened for modification	C:\Windows\System32\GroupPolicy	1718821613.976287_setup (2).exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	1718821613.976287_setup (2).exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1718821613.976287_setup (2).exe

pid process

4636 1718821613.976287_setup (2).exe
4636 1718821613.976287_setup (2).exe

pid	process
4636	1718821613.976287_setup (2).exe
4636	1718821613.976287_setup (2).exe

C:\Users\Admin\AppData\Local\Temp\1718821613.976287_setup (2).exe
"C:\Users\Admin\AppData\Local\Temp\1718821613.976287_setup (2).exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini
Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/4636-4-0x00007FFD07690000-0x00007FFD07692000-memory.dmp

Filesize
8KB

Download
memory/4636-3-0x00007FFD095D0000-0x00007FFD095D2000-memory.dmp

Filesize
8KB

Download
memory/4636-1-0x00007FFD095B0000-0x00007FFD095B2000-memory.dmp

Filesize
8KB

Download
memory/4636-5-0x00007FFD076A0000-0x00007FFD076A2000-memory.dmp

Filesize
8KB

Download
memory/4636-2-0x00007FFD095C0000-0x00007FFD095C2000-memory.dmp

Filesize
8KB

Download
memory/4636-6-0x00007FFD07100000-0x00007FFD07102000-memory.dmp

Filesize
8KB

Download
memory/4636-7-0x00007FFD07110000-0x00007FFD07112000-memory.dmp

Filesize
8KB

Download
memory/4636-8-0x00007FF69C180000-0x00007FF69D766000-memory.dmp

Filesize
21.9MB

Download
memory/4636-0-0x00007FF69C2E5000-0x00007FF69CAD8000-memory.dmp

Filesize
7.9MB

Download
memory/4636-19-0x00000257B3840000-0x00000257B38BF000-memory.dmp

Filesize
508KB

Download
memory/4636-21-0x00007FF69C2E5000-0x00007FF69CAD8000-memory.dmp

Filesize
7.9MB

Download
memory/4636-22-0x00007FF69C180000-0x00007FF69D766000-memory.dmp

Filesize
21.9MB

Download
memory/4636-25-0x00007FF69C180000-0x00007FF69D766000-memory.dmp

Filesize
21.9MB

Download