Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
10/08/2024, 12:11
General
- Target 333510272a479ebc22c3f1e585397c46.exe
- Size 5.0MB
- Sample240810-pck7wsshjd
- SHA256 4626be711dccb87a5b4e136e17e2887eadcc44c5ed201c5d1e621d7e2cfaf530
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\333510272a479ebc22c3f1e585397c46.exe"C:\Users\Admin\AppData\Local\Temp\333510272a479ebc22c3f1e585397c46.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/588-0-0x000000013FA46000-0x000000013FCB0000-memory.dmp
memory/588-3-0x0000000077A40000-0x0000000077A42000-memory.dmp
memory/588-1-0x0000000077A40000-0x0000000077A42000-memory.dmp
memory/588-21-0x0000000077A70000-0x0000000077A72000-memory.dmp
memory/588-19-0x0000000077A70000-0x0000000077A72000-memory.dmp
memory/588-17-0x0000000077A70000-0x0000000077A72000-memory.dmp
memory/588-16-0x0000000077A60000-0x0000000077A62000-memory.dmp
memory/588-14-0x0000000077A60000-0x0000000077A62000-memory.dmp
memory/588-12-0x0000000077A60000-0x0000000077A62000-memory.dmp
memory/588-11-0x000000013F8E0000-0x00000001400E1000-memory.dmp
memory/588-10-0x0000000077A50000-0x0000000077A52000-memory.dmp
memory/588-8-0x0000000077A50000-0x0000000077A52000-memory.dmp
memory/588-6-0x0000000077A50000-0x0000000077A52000-memory.dmp
memory/588-5-0x0000000077A40000-0x0000000077A42000-memory.dmp
memory/588-22-0x0000000077A80000-0x0000000077A82000-memory.dmp
memory/588-24-0x0000000077A80000-0x0000000077A82000-memory.dmp
memory/588-26-0x0000000077A80000-0x0000000077A82000-memory.dmp
memory/588-29-0x000007FEFD8B0000-0x000007FEFD8B2000-memory.dmp
memory/588-31-0x000007FEFD8B0000-0x000007FEFD8B2000-memory.dmp
memory/588-34-0x000007FEFD8C0000-0x000007FEFD8C2000-memory.dmp
memory/588-36-0x000007FEFD8C0000-0x000007FEFD8C2000-memory.dmp
memory/588-48-0x000000013FA46000-0x000000013FCB0000-memory.dmp
memory/588-49-0x000000013F8E0000-0x00000001400E1000-memory.dmp