840f75e27fcc7f37c83848e078c93b08d2e136d84e2cff1194a7ab8fefcf53fc

General

Target

Setup.exe
Size

1.6MB
MD5

d6f06bd55e0b3df26ffef8202ac50fcb
SHA1

c4aec4d3c6cb9bf1fbe8b390bd67d7de6d4d3d77
SHA256

a4f90001d9d1edba609b4e827f908672700f632cd5a8805eff48e4f68b2d6893
SHA512

dca4313afe04ac238ad34aac35b27bea0c9e577834395c9f37c720efc83fc9ad4d4bb33b8e57838ae869041219fe8fd8e17e432a0c84e56acdc9893086d0d749
SSDEEP

49152:ku8PfVQOg+l5pJXlst4igqSJYpSr80BEt2Ssc:J8Pfbg+l5/eZS3r3c

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4148	netsh.exe
3800	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4244	halres.exe
1244	halres.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	halres.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	halres.exe
File created	C:\Windows\SysWOW64\09B226B6055E526E99795DBEBEF394F4\conf\.time	halres.exe
File created	C:\Windows\SysWOW64\halres.exe	Setup.exe
File opened for modification	C:\Windows\SysWOW64\halres.exe	Setup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	halres.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	halres.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	halres.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	halres.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	halres.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	halres.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	halres.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	halres.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	halres.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	halres.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1244	halres.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 4244	304	Setup.exe	84
PID 304 wrote to memory of 4244	304	Setup.exe	84
PID 304 wrote to memory of 4244	304	Setup.exe	84
PID 1244 wrote to memory of 4148	1244	halres.exe	89
PID 1244 wrote to memory of 4148	1244	halres.exe	89
PID 1244 wrote to memory of 4148	1244	halres.exe	89
PID 1244 wrote to memory of 3800	1244	halres.exe	91
PID 1244 wrote to memory of 3800	1244	halres.exe	91
PID 1244 wrote to memory of 3800	1244	halres.exe	91

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\SysWOW64\halres.exe
  "C:\Windows\system32\halres.exe" /i
  2⤵
  - Executes dropped EXE
  PID:4244

C:\Windows\SysWOW64\halres.exe
"C:\Windows\SysWOW64\halres.exe" /s /p 27016
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall firewall delete rule name="halres.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4148
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall firewall add rule name="halres.exe" dir=in action=allow program="C:\Windows\SysWOW64\halres.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\halres.exe

Filesize
1.6MB

MD5
d6f06bd55e0b3df26ffef8202ac50fcb

SHA1
c4aec4d3c6cb9bf1fbe8b390bd67d7de6d4d3d77

SHA256
a4f90001d9d1edba609b4e827f908672700f632cd5a8805eff48e4f68b2d6893

SHA512
dca4313afe04ac238ad34aac35b27bea0c9e577834395c9f37c720efc83fc9ad4d4bb33b8e57838ae869041219fe8fd8e17e432a0c84e56acdc9893086d0d749

Download Submit
memory/304-0-0x0000000002230000-0x0000000002330000-memory.dmp

Filesize
1024KB

Download
memory/304-1-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/304-21-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1244-15-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

Filesize
1024KB

Download
memory/1244-23-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1244-25-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4244-9-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Filesize
1024KB

Download
memory/4244-20-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads