Analysis
-
max time kernel
13s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/09/2024, 01:47
General
-
Target
Firewall.exe
-
Size
101KB
-
MD5
6c38755392d50a1fd40339a1e0c890b6
-
SHA1
ccbd98910147e1b4d3d8c1c99c03e6b03480e923
-
SHA256
e39b2ddc59e30fd880d3bb1ad7bac4b7f03b66f84f948fe5c158b291ab8b25e4
-
SHA512
c2c926151226ccc93ca34a049c984e7696f0ba83863bbcd32fead26d9d3fd1a5913f3a4f1f8cb6588edd17e421743a682744569012d0c3a8d2d5925cadf9acd3
-
SSDEEP
1536:lGarUa6LowvuhdNYh2Gf9rg6hzGPnJCw1Zdr7HiNTXYlZ63uCk7U1Xap24KOQ+8n:b5BuYAVrgUCPnJCidvKTXnuXoaKlDb
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Firewall.exe"C:\Users\Admin\AppData\Local\Temp\Firewall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="" dir=out action=allow program="" enable=yes profile=public,private2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1