Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240508-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20240508-en
19 signatures
150 seconds
General
-
Target
setup.exe
-
Size
5.4MB
-
MD5
034cb49ca8d26a8ff881a093a3a1840e
-
SHA1
eb831c3938d4343379af9787e063673fa957dd2b
-
SHA256
1b34123865299a1e0d24154ab28c38232224ffdd3b6a73d1c803348483679108
-
SHA512
77b102464f7a5c0bd3085362ec872fc02b04954366b4d00a63410cef67116fe1ae960bd93edb7b298dba3979b780a9d8d980a282eb2c6fad55d77c39c244b286
-
SSDEEP
98304:fq4qkxXgnZDkE3DsMCUrUSGgykKoDJkrht130JADnKf53eooUALG5:ygX0gYsMVVGHoDa713+InKkooUMO
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
Processes:
setup.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" setup.exe -
Drops file in System32 directory 4 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy setup.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini setup.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol setup.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI setup.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2684 1252 WerFault.exe setup.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
setup.exepid process 1252 setup.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
setup.exedescription pid process target process PID 1252 wrote to memory of 2684 1252 setup.exe WerFault.exe PID 1252 wrote to memory of 2684 1252 setup.exe WerFault.exe PID 1252 wrote to memory of 2684 1252 setup.exe WerFault.exe PID 1252 wrote to memory of 2684 1252 setup.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 3362⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-0-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1252-2-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1252-4-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1252-5-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1252-7-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1252-9-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1252-14-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1252-12-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1252-10-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1252-17-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1252-19-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1252-22-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/1252-24-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/1252-27-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1252-29-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1252-32-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/1252-34-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/1252-35-0x00000000000F0000-0x0000000000AC8000-memory.dmpFilesize
9.8MB
-
memory/1252-38-0x00000000000F0000-0x0000000000AC8000-memory.dmpFilesize
9.8MB
-
memory/1252-39-0x00000000000F0000-0x0000000000AC8000-memory.dmpFilesize
9.8MB
-
memory/1252-46-0x00000000000F0000-0x0000000000AC8000-memory.dmpFilesize
9.8MB