Analysis
-
max time kernel
121s -
max time network
189s -
platform
windows10-1703_x64 -
resource
win10-20240404-es -
resource tags
-
submitted
03/10/2024, 15:21
General
-
Target
AppFile.exe
-
Size
179KB
-
MD5
7307f847abfcd35990a654365798aa0d
-
SHA1
db4657fbc9f8a455b1d2859d79a76e55802c490e
-
SHA256
2459237113947163c34ed3d3abc3dcf5599e68d193ee55e2c3590a30a1b7c8fd
-
SHA512
c773c8a646d0fa2a0fbe7ed0227fbde4fc8049ebb81d5525f477774117242181b5c7a3de52b9091cd44c7b4f335151488e4287535524e8ef639c2fe6e084d3c0
-
SSDEEP
3072:HRbKsrzJCso3JOGyQdrQO7TxoX6DCcbo/XopLxXHPQ/UEYJ:xzro3J3dXGKOXopLNvQ/UEYJ
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AppFile.exe"C:\Users\Admin\AppData\Local\Temp\AppFile.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
2.7MB
-
Filesize
9.6MB