5302d48f5691c9c661de10a4070045bada2220b6fd50d0172152bdd3e483912f

General

Target
horizon.exe
Size 5.2MB
Sample260822-j89bpsfp7v
SHA256 5302d48f5691c9c661de10a4070045bada2220b6fd50d0172152bdd3e483912f
MD5 8bc02387b3ac7ba00b03266c5ae439a2
SHA1 ebab3e6f4cfa0f329e2839c3c50f762e763d3d42
SHA512 8b7400fe16b375228c148165bfbc50fedf2153ba5d9ed2c8bad378a8d65c62588c49b3d48cc127f184c7d2086ac65c7fb777a04a880fec1566b018fa2055b000
SSDEEP 49152:mJAw8uPEAf7RDgbW6EpqPM57TJEq0aS6Nnpmmxah:aOuQ
TLSH
T10546E747E7B650D5E2BAC139A152B22BFC723495C738A3DB97814B061B61BE0ED3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
732	netsh.exe
3040	netsh.exe
3256	netsh.exe
4160	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
536	cmd.exe
1612	cmd.exe
4228	cmd.exe
3040	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	horizon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	horizon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	horizon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	horizon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	horizon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	horizon.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 536	2032	horizon.exe	83
PID 536 wrote to memory of 3040	536	cmd.exe	85
PID 2032 wrote to memory of 1612	2032	horizon.exe	86
PID 1612 wrote to memory of 3256	1612	cmd.exe	88
PID 2032 wrote to memory of 4228	2032	horizon.exe	107
PID 4228 wrote to memory of 4160	4228	cmd.exe	109
PID 2032 wrote to memory of 3040	2032	horizon.exe	110
PID 3040 wrote to memory of 732	3040	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\horizon.exe
"C:\Users\Admin\AppData\Local\Temp\horizon.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Horizon VGC Outbound Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="Horizon VGC Outbound Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Horizon VGK Service Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="Horizon VGK Service Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Horizon VGC Outbound Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="Horizon VGC Outbound Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="Horizon VGK Service Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="Horizon VGK Service Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:732