5e5d5458b8a025c2bc9a6e7998492989732967c9a1019b11d655200adf3686c7

Analysis

max time kernel
28s
max time network
172s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
Size

231KB
MD5

e3720cc15117291c5c96d88546c2da1f
SHA1

04a4577f2b96829be6706d08baf7c6013ce94b3c
SHA256

833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f
SHA512

a642e269e86e8856eb5b5864a1b75833f3f769aedc4d6e83338e3ee5b71b571f78301b8bf0b9ce5b2570d2def6c0a279018a83180e934cce8a001dc0221f2362
SSDEEP

3072:kvZlKu5E1r1Z2E6o237o7g0e1MIwdvuDFQJjCG4NdBmZK0T/:kvZlKe+BKo23ygPzhQhCNwK0T

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2152	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	tmp.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2712	2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	30
PID 2876 wrote to memory of 2712	2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	30
PID 2876 wrote to memory of 2712	2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	30
PID 2876 wrote to memory of 2712	2876	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	30

C:\Users\Admin\AppData\Local\Temp\833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
"C:\Users\Admin\AppData\Local\Temp\833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2712
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp.exe" "tmp.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\FolderN\name.exe.lnk" /f
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f
    3⤵
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\name.exe:Zone.Identifier
  2⤵
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\name.exe.jpg" name.exe
  2⤵
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
32KB

MD5
1dbfa6282eedc723ebe57ace23fd6b68

SHA1
c827aeb5c20acd10fc7eeccfb77bb0b17b2ac1d5

SHA256
8b5265c26284a2cddfd6cd0735381743b93964efe675dfad9b7ac22447d6d9e7

SHA512
f4043281ac6bbb6db64b2cab28fe3aa5ae5ce7936f3fb474ed48d253fb5f7c18ab81ee6c4267131d150763c9bf180603c64868561f6d0c2e2c76ccf33ddd1ba4

Download Submit
memory/2712-16-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-14-0x0000000070901000-0x0000000070902000-memory.dmp

Filesize
4KB

Download
memory/2712-15-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-19-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-20-0x0000000070900000-0x0000000070EAB000-memory.dmp

Filesize
5.7MB

Download
memory/2876-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2876-3-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/2876-4-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2876-5-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2876-1-0x00000000003E0000-0x000000000041E000-memory.dmp

Filesize
248KB

Download
memory/2876-0-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/2876-21-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download