5b17e265a5fb13fbc666d40aa0b2d0a53dc6844b11670f0bb8fd15100d8f18ea

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 00:43

Target

52zsoftdown/52zsoftdown_111886.exe
Size

1.3MB
MD5

db5a51efff6cf0f76abf7a19cef21cf3
SHA1

63eb5376d71418911536bf4436d1a6a98b2f4b6c
SHA256

0ee8a93b9d73ccada4260cade1319344d8f38dd43b4750983c2bcc9f9e64bea2
SHA512

c090cdf811f64c3ebe63a74677cbb662dc0efa2aa2d5ee5315af355e57c19a8c47228c8c93516f2c775c2c3e0b47cda97e4e39667191320cc0bbd6ad74fb5819
SSDEEP

24576:jxo3F/W8h5oxMkyn/RqHSi+Z3tY5g/rfleduvY//b3M:cF/XmM3trteE4D3M

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2632	netsh.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	52zsoftdown_111886.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52zsoftdown_111886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2480	2280	52zsoftdown_111886.exe	29
PID 2280 wrote to memory of 2480	2280	52zsoftdown_111886.exe	29
PID 2280 wrote to memory of 2480	2280	52zsoftdown_111886.exe	29
PID 2280 wrote to memory of 2480	2280	52zsoftdown_111886.exe	29
PID 2480 wrote to memory of 2632	2480	cmd.exe	31
PID 2480 wrote to memory of 2632	2480	cmd.exe	31
PID 2480 wrote to memory of 2632	2480	cmd.exe	31
PID 2480 wrote to memory of 2632	2480	cmd.exe	31