Analysis
- max time kernel
151s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 12:30
General
- Target archive/Setup.exe
- Size 792.5MB
- Sample240711-ppgp8syepa
- SHA256 9c6d924afa3b84241a00762d243b156a2af26374154de67a89cda3e4ef37a2c8
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\archive\Setup.exe"C:\Users\Admin\AppData\Local\Temp\archive\Setup.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4760-0-0x00007FF7458C6000-0x00007FF745B3A000-memory.dmp
memory/4760-4-0x00007FFC1B1A0000-0x00007FFC1B1A2000-memory.dmp
memory/4760-3-0x00007FFC1C030000-0x00007FFC1C032000-memory.dmp
memory/4760-2-0x00007FFC1C020000-0x00007FFC1C022000-memory.dmp
memory/4760-1-0x00007FFC1C010000-0x00007FFC1C012000-memory.dmp
memory/4760-6-0x00007FF745760000-0x00007FF745F9E000-memory.dmp
memory/4760-5-0x00007FFC1B1B0000-0x00007FFC1B1B2000-memory.dmp
memory/4760-8-0x00007FFC19D60000-0x00007FFC19D62000-memory.dmp
memory/4760-7-0x00007FFC19D50000-0x00007FFC19D52000-memory.dmp
memory/4760-20-0x000001918BD90000-0x000001918BE13000-memory.dmp
memory/4760-22-0x00007FF7458C6000-0x00007FF745B3A000-memory.dmp
memory/4760-23-0x00007FF745760000-0x00007FF745F9E000-memory.dmp