5b17e265a5fb13fbc666d40aa0b2d0a53dc6844b11670f0bb8fd15100d8f18ea

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52zsoftdown/52zsoftdown_111886.exe
Size

1.3MB
MD5

db5a51efff6cf0f76abf7a19cef21cf3
SHA1

63eb5376d71418911536bf4436d1a6a98b2f4b6c
SHA256

0ee8a93b9d73ccada4260cade1319344d8f38dd43b4750983c2bcc9f9e64bea2
SHA512

c090cdf811f64c3ebe63a74677cbb662dc0efa2aa2d5ee5315af355e57c19a8c47228c8c93516f2c775c2c3e0b47cda97e4e39667191320cc0bbd6ad74fb5819
SSDEEP

24576:jxo3F/W8h5oxMkyn/RqHSi+Z3tY5g/rfleduvY//b3M:cF/XmM3trteE4D3M

Score

10^/10

bootkit discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	52zsoftdown_111886.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	52zsoftdown_111886.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	52zsoftdown_111886.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\52zsoftdown\52zsoftdown_111886.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\52zsoftdown\\52zsoftdown_111886.exe:*:Enabled:52z一键安装器"	52zsoftdown_111886.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List	52zsoftdown_111886.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	52zsoftdown_111886.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications	52zsoftdown_111886.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\52zsoftdown\52zsoftdown_111886.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\52zsoftdown\\52zsoftdown_111886.exe:*:Enabled:52z一键安装器"	52zsoftdown_111886.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	52zsoftdown_111886.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52zsoftdown_111886.exe

C:\Users\Admin\AppData\Local\Temp\52zsoftdown\52zsoftdown_111886.exe
"C:\Users\Admin\AppData\Local\Temp\52zsoftdown\52zsoftdown_111886.exe"
1⤵
- Modifies firewall policy service
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:3944