Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 12:31
Static task
static1
Behavioral task
behavioral1
Sample
9312ea4eeda1a918922ae99a21aa1718.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9312ea4eeda1a918922ae99a21aa1718.exe
Resource
win10v2004-20240802-en
General
-
Target
9312ea4eeda1a918922ae99a21aa1718.exe
-
Size
2.7MB
-
MD5
9312ea4eeda1a918922ae99a21aa1718
-
SHA1
14985e90b26b71b219116dd072a8ed6055aa5356
-
SHA256
642b2c1febb5c0e7ba9afeb45b66b9baa7b02d0b24f8b8a3477e3bfdeffa5d6f
-
SHA512
fa1727bb597f93241abe718d1cb107c3a8e52dee6a2fc004f426215bda3aace50c1293a24bb5d670c1fd81dae2596623e4ae37bef4c0fc39c68af80d4362d625
-
SSDEEP
49152:TziCEgBRW2m7P2m9V0yO3xoNhEQfWNpp9ZM2wdXywZ12ufVKkAIbZnADTFV41b6M:TuCdm7PL9GyO3xwhEGWjXjju12OVYIVk
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
Processes:
9312ea4eeda1a918922ae99a21aa1718.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" 9312ea4eeda1a918922ae99a21aa1718.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops file in System32 directory 4 IoCs
Processes:
9312ea4eeda1a918922ae99a21aa1718.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 9312ea4eeda1a918922ae99a21aa1718.exe File opened for modification C:\Windows\System32\GroupPolicy 9312ea4eeda1a918922ae99a21aa1718.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini 9312ea4eeda1a918922ae99a21aa1718.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 9312ea4eeda1a918922ae99a21aa1718.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9312ea4eeda1a918922ae99a21aa1718.exepid process 2992 9312ea4eeda1a918922ae99a21aa1718.exe 2992 9312ea4eeda1a918922ae99a21aa1718.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9312ea4eeda1a918922ae99a21aa1718.exe"C:\Users\Admin\AppData\Local\Temp\9312ea4eeda1a918922ae99a21aa1718.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005